I have a portfolio website and i'm planning on allowing comments as a sort of "guestbook" feature. What are some things i should consider before starting? I don't want to get screwed over by a malicious user. Here's some of my thoughts
- Comment needs to be approved before appearing on the website
- Insert comment onto website as text instead of html
- Limit input size
- Storage requirements are minimal, probably going to use SQLite, therefore i'm aware of preventing sql injections. Also considering MongoDB. I'm going to be storing very little data, so I just need a simple and easy database.
Comment approval theoretically trumps all other security measures, but I want to know that i'm heading in the right direction. Like what if one day, i decide to stop moderating comments? Then the rest of the security measures should still work.