XSS

[waynew]

Hey guys, I was reading around the other day when I came across this:

 

A very common approach to circumvent XSS-cleaners is to use entities instead of plaintext, therefore the first thing we do is to remove does entities with their UTF-8 equivalent (we assume, the input is utf-8 here)

 

They suggest using:

 

$string = html_entity_decode($string, ENT_COMPAT, "UTF-8");

 

Does this mean that using htmlentities()/strip_tags() alone isn't going to stop everything?

[valtido]

if u think about it hacking is like a cats and mice chace

 

those who hack always find a way to hack, those who have been hacked always find new ways to protect their data.

 

my point is that it is safe but u cn never be 100% safe lol

[waynew]

I know. There is always going to be someone who is better than you. But it's good to stay security-minded. Make your house safer than your neighbours.

[waynew]

It's okay. I think htmlentities() will do the job. I've found instances where strip_tags( ) wasn't enough.