Sen $ _POST dizi (Eğer e-posta veya bağlantıları var istemiyorsanız en azından olanlar) her alanda üzerinde yineleme ve regexes bir çift karşı kontrol etmesi gerekir.
CAPTCHA kullanmak için öneri de iyi biridir.
Her neyse, burada denetleme berbat bir uygulaması var:
class ValidationHelper
{
// regex taken from http://code.google.com/p/prado3/source/browse/branches/3.2/framework/Web/UI/WebControls/TEmailAddressValidator.php?spec=svn2583&r=2583
const EMAIL_REGEX = "#\\w+([-+.]\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*#";
// hacked up regex that I just cooked up - could be hugely improved i'm sure.
const LINK_REGEX = "#(h\s*t\s*t\s*p\s*s?|f\s*t\s*p)\s*:\s*/\s*/#";
public static function containsEmail($value)
{
if (preg_match(self::EMAIL_REGEX, $value))
return true;
return false;
}
public static function containsLink($value)
{
if (preg_match(self::LINK_REGEX, $value))
return true;
return false;
}
}
$errors = array();
foreach ($_POST as $key=>$value) {
// presumably you want at least one email field, yeah?
if ($key != 'email') {
// perhaps you should be running strip_tags over everything if you don't want html and such...
// see http://php.net/strip_tags for more info. without it (or something similar), there's nothing
// to stop people from putting <script type="text/javascript" src="http://notyourdomain.com/~1337skriptkiddy/haxxors.js"></script>
// into your form. even if you might not necessarily ever be displaying this in a scenario
// where it can cause trouble, it's never a bad idea to stop this stuff *before* it gets into your db
$_POST[$key] = $value = strip_tags($value);
if (ValidationHelper::containsEmail($value) || ValidationHelper::containsLink($value))
$errors[] = 'Please ensure the value you entered for '.$fieldNames[$key].' does not contain any links or email addresses';
}
}
if (!empty($errors)) {
// failed - show errors.
}
else {
// success!
}
