input versus output escaping

[stijn0713]

I'm reading a little bit on escaping input and output.

 

At a first glance it seems to me that if im just taking care that all input from form inputs are safe, i will never risk a xss attack. So output handling is sort of superfluous then?

 

Does that statement make sense? If not, how could attackers insert bad html otherwise in online applications?

[requinix]

Both input and output escaping are about making sure that the data doesn't conflict with surrounding syntax or markup:

- SQL injection is when input data mixes with query syntax

- XSS is when output data mixes with HTML markup

- (Email) header injection is when data mixes with email headers

 

In between input and output (after you've cleaned up the input and before you've outputted it) the data should be exactly what was provided. You should not be escaping stuff until the moment you need to.

Example:

$name = $_POST["name"]; // O"Reilly
$name = htmlentities(mysql_real_escape_string($name)); // O\&Reilly
$email = $_POST["email"]; // user@example.com
$email = htmlentities(mysql_real_escape_string($email)); // user@example.com

mysql_query("INSERT INTO users (name) VALUES ('{$name}');"); // O&Reilly

$message = "Thank you for registering on our site, {$name}!";

// Thank you for registering on our site, O\"Reilly!
echo $message;

// Thank you for registering on our site, O\&Reilly!
mail($email, "Welcome to our site", $message);

 

What you should be doing is something along the lines of

$name = $_POST["name"]; // O"Reilly
$email = $_POST["email"]; // user@example.com

mysql_query("INSERT INTO users (name) VALUES ('" . mysql_real_escape_string($name) . "')"); // O"Reilly

$message = "Thank you for registering on our site, %s!";

// Thank you for registering on our site, O"Reilly!
printf($message, htmlentities($message));

// Thank you for registering on our site, O"Reilly!
mail($email, "Welcome to our site", sprintf($message, $name));

[stijn0713]

Ah, i see the point of doing it the moment you need it!  As for the sources of abuse, here it comes from the $_POST global, so it's user provided data through forms?

 

Are there other sources which expose vulnerabilities? Except of course, if one can hack the filesystem or the server i guess.

[requinix]

Ah, i see the point of doing it the moment you need it!  As for the sources of abuse, here it comes from the $_POST global, so it's user provided data through forms?

Uh... Yes?

 

Are there other sources which expose vulnerabilities? Except of course, if one can hack the filesystem or the server i guess.

POST, GET, some stuff in SERVER, COOKIE, raw posted data, third-party API calls... To name a few. Basically anything you didn't generate yourself.