Security of form action to a different webpage

most of forms post same page, use:

action="<?php echo $editformaction; ?>"

 

then:

$editformaction = $_server['php_self'];

if (isset($_server['query_string'])) {

$editformaction .= "?" . htmlentities($_server['query_string']);

}

 

however have forms post new url / page form action being relative url:

action = "delete-item.php"

should using html entities in form action prevent script attack , redirecting form somewhere else?

action = <?php echo htmlentities; ?>"delete-item.php"

would correct or there better way this?

on same subject should links, including general content pages , user administration pages, echo html entities prevent attack or misunderstanding something?

comments, , advise appreciated always.

thank in advance.

tessimon wrote:

 

i have forms post new url / page form action being relative url:

action = "delete-item.php"

should using html entities in form action prevent script attack , redirecting form somewhere else?

action = <?php echo htmlentities; ?>"delete-item.php"

would correct or there better way this?

no, meaningless, , generate error message because htmlentities() function requires @ least 1 argument.

 

it's you're concerned security issues, don't become paranoid. suggest take read of php security guide. it's written of best experts on subject.

More discussions in Develop server-side applications in Dreamweaver

adobe