XSS attack

I just made a simple form with the following in the text area:

I like <div good="blah" bad=blah>php</div> but not <br> XSS <img src=javascript:alert('bad!')>

When I output the data after validation, it still prints the same thing WITHOUT filtering out the "bad" stuff. Do I need to do this "cleaning" using some other functions?

ya ofcourse. you must treat all the data before output them.

if you need to output the data like username or topic ... etc

then you have to treat them before validating and clean them.

So, what function or class do you and other use to "treat" incoming data?

The forms class does not alter the HTML data that you pass to it in order to format the form output.

Take a look in the Security section for classes that can perform the kind of security filtering you need:

phpclasses.org/browse/class/78.html