Restrict Characters in TITLE attribute?

[doubledee]

Another security question...

 

Is there any reason why I would want to restrict what characters a User can use for a "Photo Label" which I am displaying using the TITLE attribute in the IMG tag??

 

Not sure if this is a possible "Attack Vector" or not?!

 

Thanks,

 

 

Debbie

 

[requinix]

No security reason. Valid reasons could include length (don't want 1000-character-long tooltips) and cleanliness (HTML tags wouldn't look pretty).

[doubledee]

No security reason. Valid reasons could include length (don't want 1000-character-long tooltips) and cleanliness (HTML tags wouldn't look pretty).

 

Okay, I guess I better add Data validation for my "Photo Label".

 

Thanks,

 

 

Debbie

 

[trq]

Like all data that is output to the browser however it also posses a potential xss threat.

[requinix]

Like all data that is output to the browser however it also posses a potential xss threat.

Right. I just focused on the user input side of things. Still have to escape it for the query, still have to escape it during output - same as always.

[doubledee]

No security reason. Valid reasons could include length (don't want 1000-character-long tooltips) and cleanliness (HTML tags wouldn't look pretty).

 

If I am using Prepared Statements, and I restrict the length like this...

 

	// ************************
	// Validate Photo Label.	*
	// ************************
	if (empty($trimmed['photoLabel'])){
		// No Photo Label.
		$photoLabel = '';

	}else{
		// Photo Label Exists.
		// Check Length.
		if (strlen($trimmed['photoLabel']) <= 40){
			// Valid Label.
			$photoLabel = $trimmed['photoLabel'];
		}else{
			// Invalid Label.
			$errors['photoLabel'] = 'Photo Label cannot exceed 40 characters.';
		}
	}//End of VALIDATE PHOTO LABEL

 

Then that should be all I need for handling input, right?

 

 

And you guys are also saying I need to modify my output...

<img src="/uploads/<?php echo validatePhoto($photoName, $photoApproved); ?>" width="100" 
		 alt="<?php echo 'Thumbnail of ' . $user ?>"
		 title="<?php echo $photoLabel; ?>"/>

 

???

 

 

Debbie

 

[Philip]

Like all data that is output to the browser however it also posses a potential xss threat.