Preventing XSS attach on php script example
<p>I have the following php pahe which accepts the user's first name and password to access a password protected site. </p>

<pre><code> &lt;?php
    /**
     * ****************************************************************************
     * Micro Protector
     * 
     * Version: 1.0
     * Release date: 2007-09-10
     * 
     * USAGE:
     *   Define your requested password below and inset the following code
     *   at the beginning of your page:
     *   &lt;?php require_once("microProtector.php"); ?&gt;
     * 
     *   See the attached example.php.
     * 
     ******************************************************************************/


    $Password = 'testpass'; // Set your password here



    /******************************************************************************/
       if (isset($_POST['submit_pwd'])){
          $pass = isset($_POST['passwd']) ? $_POST['passwd'] : '';

          if ($pass != $Password) {
             showForm("Wrong password");
             exit();     
          }
       } else {
          showForm();
          exit();
       }

    function showForm($error="LOGIN"){
    ?&gt;
    &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd"&gt;
    &lt;html&gt;
    &lt;head&gt;
    &lt;META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"&gt;
    &lt;META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE"&gt;
       &lt;title&gt;IMC - Authentication&lt;/title&gt;
       &lt;link href="style/style.css" rel="stylesheet" type="text/css" /&gt;
    &lt;Script&gt;
    &lt;!--
    function capitalize(form) {
        value = form.value;
        newValue = '';
        value = value.split(' ');
        for(var i = 0; i &lt; value.length; i++) {
            newValue += value[i].substring(0,1).toUpperCase() +
            value[i].substring(1,value[i].length) + '';
        }
    newValue = newValue.replace(/(&lt;([^&gt;]+)&gt;)/ig,"");
    form.value = newValue;
    }
    --&gt;
    &lt;/Script&gt;
    &lt;/head&gt;
    &lt;body&gt;
    &lt;center&gt;&lt;a href="http://www.test.com"&gt;&lt;img src="http://www.test.com/topLogo.png" border=0 /&gt;&lt;/a&gt;&lt;/center&gt;
    &lt;br&gt;&lt;br&gt;&lt;br&gt;
        &lt;div id="main"&gt;
          &lt;div class="caption"&gt;&lt;?php echo $error; ?&gt;&lt;/div&gt;
          &lt;div id="icon"&gt;&amp;nbsp;&lt;/div&gt;
          &lt;form action="&lt;?php echo $_SERVER['PHP_SELF']; ?&gt;" method="post" name="pwd"&gt;
        Your Name:
            &lt;table&gt;
              &lt;tr&gt;&lt;td&gt;&lt;input class="text" name="name" onBlur="capitalize(this);" maxlength=12 type="text" /&gt;&lt;/td&gt;&lt;/tr&gt;
            &lt;/table&gt; 
            Password:
            &lt;table&gt;
              &lt;tr&gt;&lt;td&gt;&lt;input class="text" name="passwd" maxlength=8 type="password" /&gt;&lt;/td&gt;&lt;/tr&gt;
              &lt;tr&gt;&lt;td align="center"&gt;&lt;br/&gt;
                 &lt;input class="text" type="submit" name="submit_pwd" value="Login" /&gt;
              &lt;/td&gt;&lt;/tr&gt;
            &lt;/table&gt;  
          &lt;/form&gt;
       &lt;/div&gt;
    &lt;/body&gt;
    &lt;/html&gt;

    &lt;?php   
    }
    ?&gt;
</code></pre>

<p>Currently it's not validating any XSS or any type of malicious attack. On my contact us page, i have the following code which ensures the user cannot enter any XSS or any kind of malicious code:</p>

<pre><code>// Clean up the input values 
foreach($_POST as $key =&gt; $value) { 
  if(ini_get('magic_quotes_gpc')) 
    $_POST[$key] = stripslashes($_POST[$key]); 

  $_POST[$key] = htmlspecialchars(strip_tags($_POST[$key])); 
}
</code></pre>

<p>Can anyone tell me where would I insert the above code in my php page to ensure no code is inserted for malicious intent.</p>
