I would like to know what school of thought trained you on server security. Injection can break a server or crack a SQL server or both, usually one follows the other.
add to the form element the value of method="POST" to tell the form to post the data rather than GET the data as your form is using GET to send data via URL and not to the server via POST.
What you need to do is unescape(), decodeURI() or decodeURIComponent() will convert the %xx values, you will have to play with the functions to get the right result.
The question is raised to "Why do you need the current page in a JS var?" the whole DOM is readily available to any script that runs in the browser, packing a page in to a variable is pretty...
Broken strings only crop up because of poor programming and attention to detail.
The idea is to code in such a way that you do not need the \ at all and only when needed.
Why not use a framework like SMARTY which is a PHP library that gives up all the abilities of a CMS that you bolt on to your existing site and develop what you need and not be reliant on others...
Is laughable, its not flaky, its the implementation. You can ONLY HAVE ONE onload event in the onload element in a document body tag or its javascript call window.onload
Most of the problems beginners experience, even some seasoned veterans trip up with things like typos and formats. If in doubt echo the output, alert() is a...
Because it s a string and if you looked at the examples I posted, you would see that yyyy/mm/dd is an acceptable string format for a date, therefore...
