How weak are your form-handling(s)??

Most of you probably know how to deal with user input in server-side scripting. When you build a site which needs user feedback (e.g Shoutbox, Guestbox and Polling) just be aware with malicious users, sometime they bored and hunted random victims. Recently, i found some guestbook and shoutbox run out from filtering user input  (i.e HTML entities). Oggix has fixed its free shoutbox when i discovered the user input isn’t perform any special chars translations. So user can inputs </html>,<!– or javascript injection to screw up your page. The link i gave at dajjal’s shoubox is also a guestbook vulner to this one. Simple way to avoid such things is to validate all variables coming from HTML form. In PHP, you can use htmlspecialchars() to convert special characters to HTML entities. Oh, yeah some people use client-side  scripting (i.e Javascript) to validate user input, but it’s breakable. You don’t need to combine client-side and server-side, just use regex in your server-side scripting.