Beginner PHP Tutorial - 72 - Using htmlentities for Security Video Lecture | PHP for Absolute Beginners: From Novice to PHP Master - Web Development

hello this is Alex from PHP academy' dog
following on from this video for the New
Boston now we've already established our
variables and we've output them in PHP
and let's just take a look at the code
again which we've basically fulfilled
all three of our requirements if you
haven't already seen this video of
creating this please go back and watch
it otherwise you're not going to
completely understand what's going on
now what we've done is we've taken the
variables we've checked whether the form
is being submitted if we submit the form
with out we say fill in all fields if we
enter something in each of these we are
displayed with this now this video is
going to deal with the security of form
data if I was say extracting data from a
database or submitting data a database
then extracting it back and anything
user submitted there's always going to
be a chance that people are going to try
and mess around with your code or with
your proper with your web application
whatever it may be now the day is Monday
the date is 31st and the year is 2011
however what's to stop me typing in this
so I'm going to have the day in bold a
normal day and then let's say let's
underline the year and I click Submit
you can see that the output to the page
is now has now been formatted depending
on what the users put in now the reason
this is dangerous is because I can in
fact say iframe source equals and a page
here I could end my iframe there and I
could type in anything here but I've
been anything there and you can see that
what's happened is is that we've we've
returned this HTML and it's echoed it
out into the page therefore we're
processing HTML on a page we don't want
our users to be able to do this and
there's a simple way that we can protect
against this a simple and effective way
to protect against this now what we do
is when
we declare our variables here day date
and year we can also include these
wrapped in functions and the function we
need is HTML entities we don't need to
worry about this here because we're not
doing anything with this data when we
check this here so for example we
wouldn't need to say HTML entities there
it would be absolutely pointless because
we're not displaying the data here we're
just checking whether this particular
variable here is set so we wrap the
function that we're eventually going to
display remember we're displaying day
down here so we need to protect by
wrapping and what we're grabbing in in
this function so HTML entities and what
HTML entities does I can show you on the
page and when we view the source of this
these entities yeah okay so HTML
entities what this is going to do is
it's going to take let's say for example
a strong tag it's going to keep the word
strong that's fine keep the word strong
here that's absolutely fine but it's
going to turn these into a value that's
rather than processed on an HTML page
it's displayed on an HTML page so for
example a pound sign like that
exists a pound sign however you want to
display a pound sign in in an HTML
format we'd use and pounds okay or I
think it's at and pound but you know I
mean so we're actually taking these and
let's view the source at the moment and
we can see what we're talking about okay
so at the moment we've got iframe source
and this is being displayed on the page
okay we need to take this away
we'll just take day away for now so for
the day I'm going to write a frame sauce
blah blah blah
31 2011 let's refresh now for the day
we've got this eye frame up now let's
view the page source and you can see
that the code exists as you would
normally type it on a page so you'd
normally type iframe if you wanted an
iframe to be displayed now this is a
massive security issue now because we're
displaying it as we might type it if we
want to create the page so with the HTML
entities what we're actually doing let's
just refresh the page is we're now just
displaying it on its own and we do this
by using these HTML entities in fact to
display everything rather than process
them as HTML tags so that's basically
the basic security around your form
there's obviously added security when
you're dealing with different things but
if you're displaying data on a page for
now this is absolutely adequate to
ensure that your users don't do things
like change the background well it can't
change the background color but iframes
are very dangerous for sort of exit XSS
tax things like that so that's basic
security on your form