Storing form data in database

Helllo friends

I have developed a form.Which allow开发者_StackOverflow中文版s the user to store there data.now when i am storing the data wat all care i must take so that my any wrong values are not inserted.Or it is not hacked

---

What you're asking about is called input validation, and there's a lot of information about it out there.

There are primarily two parts:

1. Making sure the user put in something useful.
2. Making sure the user didn't put in something harmful.

The former is most often done via JavaScript on the client side (for a generally smoother user experience and fewer postbacks). It should be re-done on the server side as well just to make sure, since you should never trust user input. Basically it involves things like regular expressions to check the format of an email address, enums to check the value of a drop down list, etc.

The latter must be done server side because you should never trust user input. It involves escaping strings against SQL injection attacks, validating field length against buffer overflow attacks (less common these days), etc.

---

Firstly you need to understand about 2 means of security.

• Sanitation
• Validation

Sanitation is cleaning data so that when you validate your data after removing any unneeded validation flaws.

Sanitation consists of removing characters such as non-visible chars (space,tabs,new-lines, ...) and they should be done across the board.

After validation your data, such as if(strlen($_GET['key']) > 0), you will be inserting the data to your database, but the ways of doing this varies depending on the database type

PHP Offers functions to escape data such as mysql_real_espae_string()

This method is refereed to as Database Escaping.

---

You need to validate your input, you can do this by Javascript functions which check the input before the form is submitted or you can also call PHP functions to check the values that the form submits before they are stored to a database. If you are using PHP you can opt to learn MVC frameworks such as CodeIgniter or CakePHP which make this process a whole lot easier and more friendly for you as a developer. Such frameworks normally have libraries with code for validations so you just need to use them and not write your own.