pcman Posted December 2, 2007 Share Posted December 2, 2007 hi how can i block xss ? but i want to show the tags like this: if the user write "<html>" its be displayed thanks Quote Link to comment Share on other sites More sharing options...
helraizer Posted December 2, 2007 Share Posted December 2, 2007 For intance $mes = htmlspecialchars($_POST['message']); echo htmlspecialchars_decode($mes); Broken down: Line 1: grabs the user's message, and if it contains the characters <html> it will return it as <html> Line 2: takes the the users message "<html>", decodes the html special characters (hence the function name) and will return the message "<html>" without them being able to inject HTML, therefore you are virtually invunerable to that type of XSS. Quote Link to comment Share on other sites More sharing options...
pcman Posted December 2, 2007 Author Share Posted December 2, 2007 thanks dude Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.