I am creating a website with the CMS MediaWiki and its extension named ContactPage. The website is principally all core and I use only that one extension ContactPage (as one which is not one of the core extensions already shipped with the MediaWiki core).

By default, the submitted ContactPage forms are not saved in MediaWiki's MySQL database so I don't fear of SQL injections, but, I do have this problem were currently MediaWiki ContactPage doesn't support a phone number field type and a website field type, so to ask a customer for a + and/or - containing phone number or a web domain would most likely require a "simple text field" field type.

From an information security standpoint, is a simple text field a good alternative for phone/website fields if a form's data isn't saved in a database?

  • XSS comes to mind... If the resulting text is parsed as HTML, it could lead to script execution on your side when you open the result later.
    – ThoriumBR
    Nov 20 '20 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.