Re: [PHP] help create community newbie guide to security

From: Raditha Dissanayake (jabber_at_raditha.com)
Date: 11/11/03 

Date: Tue, 11 Nov 2003 10:36:52 +0600
To:  php-general@lists.php.net

Nice work chris, you have left precious little for the others to comment
on :-)

>>10. Use htmlentities() on data that will be put through a SQL query to
>>prevent XSS attacks. http://php.net/htmlentities
>>
>>
>
>This is a nice suggestion. While htmlentities() cannot be guaranteed to
>defend against all XSS vulnerabilities, I would bet that most XSS
>vulnerabilities are due to a complete lack of filtering logic. If a
>developer doesn't even bother using htmlentities(), neglect is the best
>word to describe his/her approach to developing.
>
>In some cases, the developer may want certain HTML elements interpreted
>rather than escaped in this way. Perhaps you could mention that something
>like str_replace() can be used to convert specific HTML entities back to
>their original form. This method should filter any unwanted elements.
>
>
but i would still like to add 2c by saying there is also the option of
strip_tags which does a more drastic sanitization by removing anything
that smells of html. 

-- 
Raditha Dissanayake.
------------------------------------------------------------------------
http://www.radinks.com/sftp/         | http://www.raditha.com/megaupload
Lean and mean Secure FTP applet with | Mega Upload - PHP file uploader
Graphical User Inteface. Just 150 KB | with progress bar.

Relevant Pages

  • Re: $_POST case sensitivity
    ... first giving him the answer he was looking for ... to me if you are iterating over the data received from a HTML ... However, off topic of course, you can use htmlentities to ... of the tags you want to slip through. ...
    (comp.lang.php)
  • Re: $_POST case sensitivity
    ... to me if you are iterating over the data received from a HTML ... However, off topic of course, you can use htmlentities to ... Once you're happy the string is valid, you use one or the other to display the data. ...
    (comp.lang.php)
  • Re: Can the code be simplified?
    ... This is junk, not HTML. ... It is not something developer can be expected to ... It would be more efficient yet to get the moons like:- ... var moonsDiv = document.getElementById, ...
    (comp.lang.javascript)
  • Re: $_POST case sensitivity
    ... However, off topic of course, you can use htmlentities to ... encode/filter HTML form data received via the $_POST array to ... effectively strip the users input of HTML entities while still ... escaping functions where necessary. ...
    (comp.lang.php)
  • Re: $_POST case sensitivity
    ... Jerry Stuckle wrote: ... to me if you are iterating over the data received from a HTML ... BILL - please understand that all you need to use is ... However, off topic of course, you can use htmlentities to ...
    (comp.lang.php)
Loading