PHP Security Issue!

[IronicSoul]

We have a website that allows our users to add html to their profile's and such until some person thought they were real funny and posting this:

 

<iframe src=http://lancxeon.com/jack****.html</iframe>

 

On their profile, in return this contained Javascript on that remote page that acted on our site and our users in a bad way.

 

The link above no longer contains the bad code and is resolved. We would really like to know how to sensor out words/html tags that can cause XSS that our system does not normally detect as bad. Here is a snip lit of our user_class file:

 

// DECODE TO MAKE HTML TAGS FOR PROFILE FIELDS VALID
              $field_value_profile = htmlspecialchars_decode($field_value_profile, ENT_QUOTES);

            // FORMAT VALUE FOR FORM
            } else {
              if($field_info[field_type] == 2) { $field_value = str_replace("<br>", "\r\n",  $field_value); }
            }
                break; 

 

I have read ALOT on the php page on usage of htmlspecialchars and str_replace, but nothing will truly get rid of the code from being used, or at least being html-safe.

 

Any help I would greatly appreciate it!

[marklarah]

Okay, str_replace will work if use correctly. Just filter out "<iframe" to be replaced with "". Alternatively, disallow html on pages. If they want custom font sizes or images, have bbcode system in place. Other than that, why else would they need it?

[aximbigfan]

Better yet, preg_replace < with it's display code, ie & -> & This will cause the raw text to show up.

 

Chris

[D3xt3r]

You could just use a function to kill the script if it detects any bad entries.

 

$bad_codes = array("<iframe", "</script>");
foreach ($bad_codes as $bad_code) {
if (preg_match("/" . $bad_code . "/", $profile_data)) {
echo "Invalid Data";
exit();
}
}

[corbin]

amixbigfan and D3xt3r, it's much better (faster) to use strpos() or stripos() when checking just to see if a string is in another string....

 

I personally would not let users use HTML (run all output through htmlentities), and then implement a bbcode system....