eldan88 Posted July 2, 2012 Share Posted July 2, 2012 Hi, I know that PHP self has some security holes, just wanted to know if it is a good method using REQUEST_URI for an application.. not a form. Thanks! Quote Link to comment Share on other sites More sharing options...
memfiss Posted July 2, 2012 Share Posted July 2, 2012 it is a good method using REQUEST_URI for an application why not ? Quote Link to comment Share on other sites More sharing options...
haku Posted July 2, 2012 Share Posted July 2, 2012 I believe that's exactly what he is asking. Quote Link to comment Share on other sites More sharing options...
PFMaBiSmAd Posted July 2, 2012 Share Posted July 2, 2012 $_SERVER['REQUEST_URI'] has the same issue as $_SERVER['PHP_SELF']. If the requested URL contains any xss scripting in it and you blindly echo it out on a page back to the browser without using htmlentities/htmlspecialchars on it, then the xss scripting in it will be sent as is to the browser. You must always treat external data (anything received with the http request, even the URL itself) as dangerous and must filter/validate it if you are going to output it back to any browser. Quote Link to comment Share on other sites More sharing options...
xyph Posted July 2, 2012 Share Posted July 2, 2012 To simplify the answer, if you want to output the value of $_SERVER['REQUEST_URI'] to the browser, you're completely safe if you reference it like this: htmlspecialchars($_SERVER['REQUEST_URI']) That will sanitize any characters that might be used to perform an XSS attack. Keep in mind, if you're using a special character set, you need to define that in the function's call... check out the manual for more details: htmlspecialchars Quote Link to comment Share on other sites More sharing options...
eldan88 Posted July 16, 2012 Author Share Posted July 16, 2012 thanks a lot guys!!! I have wrapped the REQUEST_URI with a htmlspecialchars function. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.