Filtered input

In the previous lesson you saw that if the remote server doesn't filter the input we give it we can wreak havock.

As script must typically be between <script> and </script> tags one simple approach taken by sites is to simple remove those tags.

This next form behaves exactly the same as the previous one, type in a message and see it displayed to the user, the only difference is that this time the '<script>' tags are removed.

Notice how the simple trick we used last time no longer works? Read on to see how we deal with this.



Return to index