how to remove html and javascript from input field before sending to server - sanitize

<form action="process_reg.php" method="post" name="register_form" id="register_form">
<input class="logbar" id="fname" name="fname" type="text" placeholder="Firstname" onfocus="CheckFname(); return true;" onblur="leaveFname();" required>
<span id="fnameMessage"></span>
<input class="logbar" id="lname" name="lname" type="text" placeholder="Lastname" onfocus="CheckLname(); return true;" onblur="leaveLname();" required>
<span id="lnameMessage"></span>
<input class="logbar" id="email" name="email" type="text" placeholder="Email" onfocus="CheckEmail();" onblur="leaveEmail();" required>
<span id="emailMessage"></span>
<input class="logbar" id="password" name="password" type="password" placeholder="Password" keyev="true" required >
<input class="logbar" id="password2" name="password2" type="password" placeholder="Confirm Password" onkeyup="checkPass(); return false;" required>
<span id="confirmMessage" class="confirmMessage"></span>
<input value="Logga in" type="button" onclick="formhash(this.form, this.form.password);" id="register">
</form>
and the Sanitize/XSS protection that i applied on this form is given
if (empty($_REQUEST) === false)
{
$regemail1 = filter_input('INPUT_REQUEST', 'email', 'FILTER_SANITIZE_EMAIL');
$regfirst1 = filter_input('INPUT_REQUEST', 'fname', 'FILTER_SANITIZE_SPECIAL_CHARS');
$reglast1 = filter_input('INPUT_REQUEST', 'lname', 'FILTER_SANITIZE_SPECIAL_CHARS');
$regpass = $_POST['p'];
$regemail = htmlspecialchars($regemail1);
$reglast = htmlspecialchars($reglast1);
$regfirst = htmlspecialchars($regfirst1);
$regemail =
}
When I enter Hi it is perfect in a way that it stop the function of tag. but I want to send only text to the database and remove all the other things.

The only value being send to the server in the sample bellow is what ever is input field, you don't send html to server.
<input class="logbar" id="password" name="password" type="password" placeholder="Password" keyev="true" required >
you always check what you are getting in the server by printf, echo

Related

I can't check the empty or null when I click submit

I can't check the empty or null when I click submit.
When pressing the spacebar, the empty value will be sent to the database.
button can submit pass to sent data to database
Please help.
<form #Register="ngForm">
<div style="width: 500px">
<br/>
<h4>New Reegister</h4>
<br/>
<div class="form-group">
<dt><label for="name">Name</label></dt>
<input [(ngModel)]="name" name="name" type="text" class="form-control" placeholder="input your name" data-bv-notempty-message="The name is required" required>
</div>
<div class="form-group">
<dt><label for="lastname">LastName</label></dt>
<input [(ngModel)]="lastname" name="lastname" type="text" class="form-control" placeholder="input your lastname" data-bv-notempty-message="The lastname is required" required>
</div>
<div class="form-group">
<dt><label for="email2">E-mail</label></dt>
<input [(ngModel)]="email2" name="email2" type="text" class="form-control" placeholder="input your email" data-bv-notempty-message="email" required [pattern]="emailRegex" >
<div class= "p-2 text-danger"> <small>* Require Example : xxxxx#gmail.com</small> </div>
</div>
<div class="form-group">
<dt><label for="password2">Password</label></dt>
<input [(ngModel)]="password2" name="password2" type="password" class="form-control" placeholder="input your password" minlength="4" required>
<div class= "p-2 text-danger"> <small>* Enter atleast 4 characters</small> </div>
</div>
<!--
<div class="form-group">
<label for="password3">Password Confirm</label>
<input [(ngModel)]="password3" name="password3" type="password" class="form-control" placeholder="input your password" required>
</div>
-->
<div class="form-group">
<dt><label for="passwordhint">Password Hint</label></dt>
<input [(ngModel)]="passwordhint" name="passwordhint" type="password" class="form-control" placeholder="input your password" minlength="4" required>
<div class= "p-2 text-danger"> <small>* Enter atleast 4 characters</small> </div>
</div>
<button type="submit" type="reset" class="btn btn-danger" [disabled]="!Register.valid" (click)="Regis()">Save</button>
</div>
</form>
cannot check data null
When pressing the spacebar, the empty value will be sent to the database.
button can submit pass to sent data to database
Please help.
Data " " is a valid data but it's empty, not null. You can make a check by trim function before saving it into database.
For example:
let str = ' ';
console.log(str.length) // Length = 1
str = str.trim();
// Here str = '' and you can check length of it
console.log(str.length) // Length = 0
More detail: trim
This has to go in the submit button.
In this case if the variable 'name' contain only spaces the function 'trim' will reduce its length to 0.
So the database call will happen only if the variable 'name' has a value.
this.name = this.name.trim();
if(name.length) {
// do the database call
} else {
// prompt a message to let the user know that the particular field is empty
}

why i cant get data from html form using post method?

i have using ejs engine to get and post method.When i use http://localhost:8080/signup, i will get a sigup form where i can input my values. The problem is after submitting the form,i am unable console the value of "req.body". Help me?
app.post('/signup',urlencodedParser,function(req,res){
//console.log(req)
var names = req.body;
console.log(names);
res.end("sigup submitted");
});
app.get('/signup', function(req, res) {///////////signup ejs loading
res.render('signup')
});
<form id="signupForm" enctype="multipart/form-data" method="post" action="">
<div class="container">
<h1>Sign Up</h1>
<p>Please fill in this form to create an account.</p>
<hr>
<label for="name"><b>Company Name</b></label>
<input type="text" placeholder="Company Name" name="name" required>
<label for="email"><b>Email</b></label>
<input type="text" placeholder="Enter Email" name="email" required>
<label for="psw"><b>Password</b></label>
<input type="password" placeholder="Enter Password" name="psw" required>
<label for="psw-repeat"><b>Repeat Password</b></label>
<input type="password" placeholder="Repeat Password" name="psw-repeat" required>
<label for="psw-repeat"><b>Address</b></label>
<input type="text" placeholder="Address" name="address" required>
<label>
<input type="checkbox" checked="checked" name="remember" style="margin-bottom:15px"> Remember me
</label>
<p>By creating an account you agree to our Terms & Privacy.</p>
<div class="clearfix">
<button type="button" class="cancelbtn">Cancel</button>
<button type="submit" class="signupbtn">Sign Up</button>
</div>
</div>
</form>
Express does come with some body parsers, but if you are using multipart/form-data then answer would be https://github.com/expressjs/multer not
You can even read that https://www.npmjs.com/package/body-parser (aka body-parser) also do not read multipart/form-data as they can be complicated and should be used only when files are sent.

Extra Underline in Material Component(Angular2)

I am new in Material Component and facing a problem since yesterday. I am using a input text filed for design a signup form but every field take extra underline, I cannot find out the issue please.
<form class="example-form" (ngSubmit)="onSignup(f)" #f="ngForm">
<label class="registr">Registration Form</label>
<table class="example-full-width" cellspacing="0"><tr>
<td><mat-form-field class="example-full-width">
<input matInput id="fname" name="fname" placeholder="First name">
</mat-form-field></td>
<td><mat-form-field class="example-full-width">
<input matInput id="lname" name="lname" placeholder="Last Name">
</mat-form-field></td>
</tr></table>
<table class="example-full-width" cellspacing="0"><tr>
<td><mat-form-field class="example-full-width">
<input type="email" matInput placeholder="Enter your email" id="email" name="email" [formControl]="email" required>
<mat-error *ngIf="email.invalid">{{getErrorMessage()}}</mat-error>
</mat-form-field></td>
<td><mat-form-field class="example-full-width">
<mat-select placeholder="Select Role">
<mat-option *ngFor="let role of roles" [value]="role" value="option" required>{{role}}</mat-option>
</mat-select>
</mat-form-field></td>
</tr></table>
<mat-form-field>
<input type="password" matInput placeholder="Enter your password" id="password" name="password" [type]="hide ? 'password' : 'text'">
<mat-icon matSuffix (click)="hide = !hide">{{hide ? 'visibility' : 'visibility_off'}}</mat-icon>
</mat-form-field>
<button type="button" class="btn btn-info d-none d-lg-block m-l-15" type="submit">Sign Up</button>
</form>

Register new 'etudiant'

Hello so i want to register a new user called 'etudiant' in my mongodb with a post request with
<form method="post" action="register">
<h1>Create Account</h1>
<div>
<input type="text" class="form-control" placeholder="first_name" required="required" name="first_name"/>
</div>
<div>
<input type="text" class="form-control" placeholder="last_name" required="required" name="last_name"/>
</div>
<div>
<input type="text" class="form-control" placeholder="cin" required="required" name="cin"/>
</div>
<div>
<input type="text" class="form-control" placeholder="adress" required="required" name="adress"/>
</div>
<div>
<input type="text" class="form-control" placeholder="date_naissance" required="required" name="date_naissance"/>
</div>
<div>
<input type="email" class="form-control" placeholder="Email" required="required" name="mail"/>
</div>
<div>
<input type="password" class="form-control" placeholder="Password" required="required" name="pwd"/>
</div>
<div style="margin:auto;">
<center><input type="submit" value="Register"></center>
</div>
</form>
and the controller for this form is
function register (req, res) {
//create etudiant
var etudiant{
first_name:req.body.first_name,
last_name:req.body.last_name,
cin:req.body.cin,
adress:req.body.adress,
username:req.body.username,
email:req.body.email,
pwd:req.body.pwd
}
//use etudiant model to insert/save
var newetudiant = new Etudiant(etudiant);
//save etudiant
newetudiant.save();
//redirect
res.redirect('/');
}
in the console i got this error that i don't find a solution for
my error
i'm sorry i was working 9hours straight i didn't see my error xD
problem solved still if you look at the
newetudiant.save();
it's right but still doesn't save data to the db

Empty message with Formt in MODx

Here is my code of send-page:
<p>[[!FormIt?
&hooks=`email,FormItLog,spam,emailUser,redirect`
&emailTo=`heash94#gmail.com`
&emailSubject=`[[+subject]]`
&emailFromName=`[[+name]]`
&emailTpl=`ContactTpl`
&redirectTo=`62` ]]</p>
<div>[[+fi.error.error_message]]</div>
<form action="[[~[[*id]]]]" method="post"><input type="hidden" name="nospam:blank" value="" />
<div>
<label for="name">Name: </label> <input id="name" type="text" name="name:required" value="[[+fi.name]]" /> <span>[[+fi.error.name]]</span>
</div>
<div>
<label for="name">Email: </label> <input id="email" type="text" name="email:email:required" value="[[+fi.email]]" /> <span>[[+fi.error.email]]</span></div>
<div>
<label for="subject">Theme: </label> <input id="subject" type="text" name="subject:required:stripTags" value="[[+fi.subject]]" /> <span>[[+fi.error.subject]]</span></div>
<div>
<label for="message">Text: </label><span>[[+fi.error.message]]</span> <br /> <textarea id="message" name="message:required:stripTags" rows="7" cols="55">[[+fi.message]]</textarea></div>
<div>
<input type="submit" name="Submit" value="Отправить" /></div>
</form>
I tried many examples, but they send to my email empty messages.
Here is my reciver-page code:
This message [[+name]] ([[+email]]) was sand with callback form:
[[+message]]
But in response I have only "This message () was sent with callback form: ".
Modx Revolution.
Sounds like modx is not seeing the name="email:email:required" as 'email' - put your CSS/JS validation in another attribute & also use the &validate attribute for the formit call.

Resources