|
Re: database programming
One of my current projects (non-FIRST, so it's sorta on hold) is designing an e-commerce site for shareware/independent commercial software, and you wouldn't believe how much validation form submissions go through. Suffice to say that just about any input is limited to only the exact characters you would need for a response to that. For instance, an email field is only allowed the characters "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW XYZ@-_.0123456789", because those are the only characters one would need for an email address.
But the one thing you never want to let people do is submit HTML tags in any form that is going to be displayed back to the user.
|