eForm default security settings?

I’m curious to learn if eForm has some default settings when it validates. For example, does it cleanse the data before I use another snippet to post the data to the database?

Also, does anyone out there use custom validation rules to acheive this result? If so, what do you use?

I ask because I recently had a project that used eForm to post petition "signatures" to a database, and I was concerned about XSS. Thanks!

Quote from: cmuluna at Feb 20, 2009, 09:54 AM

I’m curious to learn if eForm has some default settings when it validates. For example, does it cleanse the data before I use another snippet to post the data to the database? Also, does anyone out there use custom validation rules to acheive this result? If so, what do you use?

Use provided field validations (required, datatypes, email etc.), then $modx->db>escape() method to prepare records for database operations and you’ll be fine.

Excellent. I’m still learning the MODx database API, so I appreciate the direction. That helps a lot.