Jump to content

Avoiding XSS Attacks


master82

Recommended Posts

Ive just been told that a script of mine is vunerable to XSS.

 

Basically the script allows a user to into anything into the field, it is then stored into the database and retrieved and shown in a table.

 

Apparently I need to strip things out of it or something? Not completely sure as I have no idea what an XSS attack is lol

 

Can someone help by telling me what I should do with the input?

Link to comment
https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/
Share on other sites

Ok ive looked into those and googled for the past hour or so, seems everyone explains what it is but doesnt provide any sort of good working solution.

 

So can I ask, I have the variable $_POST['text'], what should I do to it before I place it into the database, and what would i need to do when retrieveing it for viewing?

 

Thanks ;D

Link to comment
https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-179206
Share on other sites

Another issue you want to worry about with something like this is SQL Injections.

 

The first thing you want to do is make sure the user that does the data insertion has very limited privileges. INSERT, SELECT, and maybe UPDATE should be all you really need.

 

Also, strip_tags(), htmlentities(), addslashes(), urlencode(), etc. are good for sanitizing.

Link to comment
https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-179217
Share on other sites

If you have unsanitized user content, then anyone can post Javascript on your site to read your user's cookie and send it to a server they have control of. You use these string functions to remove any tags they are trying to put in, before they hit the database.

 

Read the type 2 attack information:

http://en.wikipedia.org/wiki/Cross_site_scripting

 

Link to comment
https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-179231
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.