Security threats in mind:
SQL Injections!!! --- Solutions: Prepared Statements (PDO) and including
$bpdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);in the database connection
XSS Attacks!!! --- Solutions: htmlspecialchars(), Content-Security Policy (placed in htaccess).
OS Command Attacks!!! --- Solutions: Striping whitespace.
DOS Attacks!!! --- Solution: None implemented. I'm unsure if any additional precaution is necessary, since there are no login possibilities on my website.
Is the following script sufficient enough to sanitize user input?
//sanitize user input $Tmessage = trim(preg_replace('/\s\s+/', ' ', htmlspecialchars($_POST["message"]))); $sanitizedMessage = filter_var($Tmessage, FILTER_SANITIZE_STRING); //prepare info and submit into table $stmnt = $pdo->prepare("INSERT INTO submissionsTable (message) VALUES (:message)"); $stmnt->execute(['message' => $sanitizedMessage]); header("Location: success.html"); exit (0);