How can we avoid my php form from hacking

Question

I wanted to know how can i  avoid $_SERVER["PHP_SELF"]  from exploits?

Answer 1

Hii @kartik,

If you want to know php from can led to vulnerability check it out- PHP Form Security

  $_SERVER["PHP_SELF"] exploits can be avoided by using the htmlspecialchars() function.

The form code should look like this:

<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">

The htmlspecialchars() function converts special characters to HTML entities. Now if the user tries to exploit the PHP_SELF variable, it will result in the following output:

<form method="post" action="test_form.php/&quot;&gt;&lt;script&gt;alert('hacked')&lt;/script&gt;">

The exploit attempt fails, and no harm is done!