Hey everyone, well I want my users to be able to embed something on their profile. But, i heard that someone can do a mysql injection, if the embed the right thing. How would i prevent that. I want my users to be able to embed this music player, in sort of a form. Then, after they submit it, that form displays the player. But, apparently, users can put a php code in it and ruin the site. Any ideas on how to prevent it?
No, i want the user to be able to embed their own music player, with their own music. There is a website that I am going to iframe, then they fill all the things out, with their favorite music, they take the embed code, past it into there, and there it is. Only thing is, i think people can hack my website from that, by putting in there own code
No i provide the music player, they fill out a form with their favorite music, their music player skin, ect. Then it spits out an embed code, and they embed that.
They embed that code that it spits out, into this other form on the edit profile options. They put the embed code into the form, and boom, its on their profile. The only problem is, I dont want them to put stuff php code or mysql strings that can hack my website, into this embed form
Ok so picture this. There is an edit profile page, with an iframe to a custom music player website, and above that is this form. They use the iframe, like they are on the website, fill out all the information, like the songs they wanna put on their playlist, ect. Well after they fill out that form, it gives them an embed code, that they can paste into the form they have above the iframe.
I apologize that I just don't understand your project.
Maybe someone else might be able to figure this out.
I really hate to give you any wrong answers or misleading information.
I would never let anyone upload a script, or Flash Player into my website.
If that's what is going to happen, then I guess I would say "don't do it".
k let me explain this simpler. Like would u allow someone to embed a video onto ur users profile? Thats basically what im doing, but its not a video, its a widget. Basically a profile widget
You need to provide the widget they are inserting into their profile page.
You can't let them upload scripts to your site. Not even a Flash script.
You create a widget that plays MP3 music files (a playlist).
That widget might be a Flash player, or whatever you use.
They insert THAT widget ... from your site.
When they edit their profile, they should not see any scripting for that widget.
You can't let them edit any PHP scripting, or have any visible scripting.
They then can upload MP3 files to a directory ... which becomes the playlist.
Why can't they use YOUR music player?
It's your website.
Before you post, read our: 
Embed Help
