master82 Posted February 6, 2007 Share Posted February 6, 2007 Ive just been told that a script of mine is vunerable to XSS. Basically the script allows a user to into anything into the field, it is then stored into the database and retrieved and shown in a table. Apparently I need to strip things out of it or something? Not completely sure as I have no idea what an XSS attack is lol Can someone help by telling me what I should do with the input? Link to comment https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/ Share on other sites More sharing options...
Jessica Posted February 6, 2007 Share Posted February 6, 2007 Google for Cross site scripting and XSS. You'll need to use things like strip_tags(), htmlentities(), etc. There are some good articles on how to stop it. Basically, sanitize ALL user input ALWAYS. Link to comment https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-177822 Share on other sites More sharing options...
master82 Posted February 7, 2007 Author Share Posted February 7, 2007 Ok ive looked into those and googled for the past hour or so, seems everyone explains what it is but doesnt provide any sort of good working solution. So can I ask, I have the variable $_POST['text'], what should I do to it before I place it into the database, and what would i need to do when retrieveing it for viewing? Thanks Link to comment https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-179206 Share on other sites More sharing options...
redbullmarky Posted February 7, 2007 Share Posted February 7, 2007 the manual entries for htmlentities() and htmlspecialchars() do have good mentions and examples of avoiding XSS, notably in the user comments section. cheers Link to comment https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-179216 Share on other sites More sharing options...
Balmung-San Posted February 7, 2007 Share Posted February 7, 2007 Another issue you want to worry about with something like this is SQL Injections. The first thing you want to do is make sure the user that does the data insertion has very limited privileges. INSERT, SELECT, and maybe UPDATE should be all you really need. Also, strip_tags(), htmlentities(), addslashes(), urlencode(), etc. are good for sanitizing. Link to comment https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-179217 Share on other sites More sharing options...
Hypnos Posted February 7, 2007 Share Posted February 7, 2007 If you have unsanitized user content, then anyone can post Javascript on your site to read your user's cookie and send it to a server they have control of. You use these string functions to remove any tags they are trying to put in, before they hit the database. Read the type 2 attack information: http://en.wikipedia.org/wiki/Cross_site_scripting Link to comment https://forums.phpfreaks.com/topic/37220-avoiding-xss-attacks/#findComment-179231 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.