如何阻止人們將代碼放入我的表單中？

Question

所以，我有一個表單輸入數據庫，然後這些值在頁面上回顯。我一直在試圖弄清楚如何在通過表單處理時禁用所有代碼。

這是我的形式：

<div id="postForm"> 
     <form method="post" action="post.php" id="messageForm" autocomplete="off"> 
      <table border="0" align="center"> 
       <tr><td id="formBlock"><span>Name</span></td> 
       <td><input id="messageName" name="name" type="text" value="Anonymous" maxlength="32" required> 
        <input style="margin-right: -1px; margin-left: -4px;" type="submit" name="Submit" value="Send Message"></td></tr> 
       <tr><td id="formBlock"><span>Title</span></td> 
        <td><input id="messageTitle" name="title" type="text" maxlength="32" width="20"></td></tr><br> 
       <tr><td id="formBlock"><span>Message</span></td> 
        <td><textarea onkeyup="countChar(this)" name="message" rows="6" cols="50" form="messageForm" maxlength="2000" style="font-family: arial;" required></textarea></td></tr> 
      </table> 
     </form> 
      <table align="center" style="width: 290px; border: 0px;"> 
       <td><div id="warningText" style="font-size: 10px; margin-top: -15px;">Please read the FAQ before posting!</div></td> 
       <td><div id="messageText" style="font-size: 10px; margin-top: -15px; text-align: right;"></div></td> 
      </table> 
    </div> 

這該是多麼的條目被附和道：

<div id="messages"> 
     <?php 
      $servername = "localhost"; 
      $username = "user"; 
      $password = "pass"; 
      $dbname = "db_posts"; 
      $tablename = "posts"; 

      $conn = new mysqli($servername, $username, $password, $dbname); 
      if ($conn->connect_error) { 
       die("failed to connect: " . $conn->connect_error); 
      } 

      $sql = "SELECT id, rating, name, title, message, date, time FROM posts ORDER BY date DESC, time DESC"; 
      $result = $conn->query($sql); 


      if ($result->num_rows > 0) { 
       while($row = $result->fetch_assoc()) { 
        echo "<br><div id='messageBar'><b><a class='rateup' href='index.php' data-id=' " . $row['id'] . " ' title='vote up'>&#9650;</a> "; 
        echo $row["rating"]; 
        echo " <a class='ratedown' href='index.php' title='vote down'>&#9660;</a> </b>"; 
        echo "Posted by <b>"; 
        echo $row["name"]; 
        echo "</b> on "; 
        echo $row["date"]; 
        echo " at "; 
        echo $row["time"]; 
        if (!empty($row['title'])) { 
         echo " - <b>"; 
         echo $row["title"]; 
         echo "</b>"; 
        } 
        echo "<span style='float: right'>#"; 
        echo $row["id"]; 
        echo "</span>"; 
        echo "</div><div id='messageContent'>"; 
        echo $row["message"]; 
        echo "</div><br><hr>"; 
       } 
      } else { 
       echo "<br>"; 
       echo "<center><i>it's dusty in here</i></center>"; 
       echo "<br>"; 
      } 

      $conn->close(); 
     ?> 
    </div> 

我敢肯定，有一個更好的辦法，我可以附和所有的數據，所以如果有人有任何建議隨時讓我知道。

TL; DR：如果有人在我的表單中輸入<b>text</b>，我希望它回顯爲<b>text</b>。

Answer 1

當用戶數據呈現在屏幕上時，最常見的是對用戶數據進行編碼。我不使用PHP，但可以使用htmlentities（）函數。

通過這種方式，任何可以在瀏覽器中解釋爲命令的字符都被編碼爲與原來輸入完全相同。