Hello there. I was wondering what's wrong with my code because when user process his data, I manipulate that data and prevent possible hacker exploits. BUT, somehow when user enter some javascript or html, the data is not transformed as I wanted to be. Here is code:
<html>
<body>
<form method="POST" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']);?>">
<input type="password" name="pwd">
<input type="submit" value="Click me">
</form>
<?php
$pass = "";
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
if($_SERVER['REQUEST_METHOD'] == "POST") {
$pass = test_input($_POST['pwd']);
echo $pass;
}
?>
</body>
</html>So, when the user enter password, it will be changed with 3 functions. However, htmlspecialchars function seems not to work because when I enter: <html> , it's not masked to be &l;thtml> but print out <html> . Why? Where I make mistake?
