Stop Authors from submitting spam post

Question

I am designing a frontend for users, where they can submit an article/post from. But i am worrying if someone puts javascipt code, or SQL injection, or other malicious code. Is there a plugin or some sort of scripts which can help me to filter the post contents from security point of view.

I'll appriate if someone can suggest me some code/script/plugin which can help to define rule over submmited contents like

1. No. of external hyperlinks
2. No. of Images
3. Length of content etc.

Although i can do it manually. So the lower part of the question is less important.

Answer 1

If your really worried I would probably create custom write panels or custom meta boxes tied into custom post types. That way you can make the custom post types based on user role and control what shows up very easily.

For instance you can make a custom post type called "tweens" with the user role of "contributor" so they can write posts but not submit them.

Using custom meta box's with a custom post type will give you complete control over what kind of data is submitted. For instance if you want to limit the above post type "tweens" to 5 images you only supply 5 image meta boxes, or limit the amount of words per text box, or strip urls or js, or remove the wysiwyg, etc ( anything really).

Some references:

http://codex.wordpress.org/Roles_and_Capabilities#Contributor http://codex.wordpress.org/Function_Reference/register_post_type http://codex.wordpress.org/Function_Reference/add_meta_box

Answer 2

You can use JQuery to validate the content of the front-end fields/text areas and if you find anything that looks like a code or other strings you can disable the post process. Also you can request the users to register first (before they get access to the post form). Also you can set the post status to draft or to an another category you want, before you approve it.