<%Function BurnBadInput (rVar,rType)
Set regEx = New RegExp
regEx.Global = true
regEx.Pattern = "[^0-9a-zA-Z\@\w\.\,\-\_\b\r\ \-]"
IF rType  = "querystring" THEN
BurnBadInput = regEx.Replace(request.querystring(rVar), "")
ELSEIF rType  = "form" THEN
BurnBadInput = regEx.Replace(request.form(rVar), "")
ELSEIF rType  = "cookie" THEN
BurnBadInput = regEx.Replace(request.cookies(rVar), "")
ELSEIF rType  = "string" THEN
BurnBadInput = regEx.Replace(rVar, "")
END IF
End Function%>

Using this function to cleanse your querystring, form, cookie or string data is simple. Firstly you place the code above into the HEAD section of your page and then you call the querystring or form as shown.

Instead of:

<% User_Input = request.querystring("EXAMPLE") %>

You request the input using the function, as shown:

<% User_Input = BurnBadInput("EXAMPLE","querystring") %>

You can cleanse other request types such as FORM, COOKIE, or plain STRING as shown below:

<% User_Input = BurnBadInput("EXAMPLE","form") %>

<?php
function burnBadInput($fire){
if (get_magic_quotes_gpc())
{$flame=stripslashes($fire);}
else {$flame=$fire;}
return mysql_real_escape_string($flame);
?>

Using this function to cleanse your querystring, form, cookie or string data is simple. Firstly you place the code above into the HEAD section of your page and then you call the querystring or form as shown.

Instead of:

<?php $User_Input = $_POST['EXAMPLE'] ?>

You request the input using the function, as shown:

<?php $User_Input = burnBadInput($_POST['EXAMPLE']) ?>

You can cleanse other request types such as FORM, COOKIE, or plain STRING as shown below:

<?php $User_Input = burnBadInput($_GET['EXAMPLE']) ?>

<script type="text/javascript">
<!--
function valBadInput(){
var fire = /[\(\)\<\>\,\;\:\\\"\[\]]/ ;
if(document.getElementById('EXAMPLE')!='')
{
var_data = document.getElementById('EXAMPLE');
if (!fire.test(var_data))
{
alert('The EXAMPLE field contains illegal characters!');
return false;
}
}
}
//-->
</script>

Using this function to validate a form is simple. Firstly you place the code above into the HEAD section of your page and then you call the function using the 'onsubmit' call within a form. (it is important to note that Javascript validation must be used in conjunction with good server side validation)

Add this to your form:

onsubmit="return burnBadInput();"

So an example form would look like this:

<form action="/EX/" method="post" onsubmit="return valBadInput();"> 

This script would validate an input field that had the id 'EXAMPLE' but can easily be modified to accept many more fields etc.