php - A few questions about Form processing.? -

i know ways add more security forms prevent attacks. past few days of searching in web, , methodology adopt, i've found number of solutions know take before proceeding.

1. is have include form keys prevent xss (cross-site scripting) , cross-site request forgery?

2. which best way process form data:

   1. ajax
   2. place form processing code on top of same page , process using $_server['php_self']
   3. set action of form page , process value there.
   4. process form value through single php class file.

3. which best way filter or sanitize form data?

thank you

here normal set. use custom framework, basically.

i setup models handle specific data. example, if have employee form creates new employees. have employee model. model has specified values requires in order generate new employee in database. if values missing in model, when try save it, throw exception. second layer of "input validation". first layer simple java script form validator, make sure values aren't missing.

now, sort of input page(get, post), have class handles these sanitation. iterates on of $_post , $_get values , sanitizes them(mysql_real_escape_string, stripslashes in php).

now setting form data in html.. php can process form data "arrays" , mean if have form input named "employee[name]" , submit form, php recognize form submission $_post['employee']['name'].. pretty amazing know. now, each form has own specified fields required model. call model, set model data $inputclass->post('employee') (which array) , save data.

i prefer general method anything. fast , easy setup, secure , works.

edit: also, ajax , javascript luxuries. don't need these process forms, add ease user. example, pending have javascript enabled, can validate form without reloading page. note, should validate forms via php well.