what EXACTLY do i need to DO to stop cross site scripting?

[spikeon]

ok guys, i have a site that has alot of text inputs.  what do i need to to to make sure that noone posts anything that can hurt the site or steal information?

for instance

$stuff = what_other_functions_do_i_put_here(strip_tags($stuff));

[deadonarrival]

I use a function called clean()

 

I won't give you mine, because it's quite bloated, but it basically follows the idea of

 

<?php
function clean($var)
{
/*
  * Use preg_replace to replace things such as javascript: and any other nasties you can think of. This is the bloated bit.
  * Done because things like javascript: aren't caught by strip_tags. I also remove certain javascript functions for good measure
  */

//Take out any slashes, in case php is set to add them
$var = stripslashes($var);
//Now add in our own slashes
$var = mysql_real_escape_string($var);
//Strip any html tags
$var = strip_tags($var);
//Convert any special chars
$var = htmlspecialchars($var);
}
?>

 

Between these it's safe to use in html and mysql queries. I don't think there are any others you'd need.

 

Just use it by calling

$username = clean($_POST['username']);

 

You could even extend it by having a switch to get the variable from post/get/session/cookie superglobals, and use the function as

$username = clean($username,"post");

 

I'll send an example of that if you want to take a look. I use it since it's a little cleaner and less error prone.

[spikeon]

well, using that heres what i'm doing, to clean EVERYTHING

 

foreach($_GET as $key => $stuff){
$_GET[$key] = htmlspecialchars(strip_tags(mysql_real_escape_string(stripslashes($stuff))));
}
foreach($_POST as $key => $stuff){
$_POST[$key] = htmlspecialchars(strip_tags(mysql_real_escape_string(stripslashes($stuff))));
}

[uniflare]

depends on howyou use the variables inside your script;

 

Using RAW User Data to Echo on a page

htmlentities($userdata);

Protect against: Javascript XSS/HiJack Etc

 

Using RAW User Data in a MySQL Query

mysql_escape_string($userdata);

Protect against: Mysql Injection

 

Using RAW User Data in a fopen function or similar

// Dont use RAW User data in predefined functions whenever possible, validate with preg_match etc if you have to

Switch($_POST['file']){
      Case "1":
            $file = "file1.db";
      Break;

      Case "2":
            $file = "file2.db";
      Break;

      Case "3":
            $file = "file3.db";
      Break;
      
      default:
            $file = "file.db";
      break;
}
fopen($file,"r+");

// SAME FOR INCLUDE/_ONCE / REQUIRE/_ONCE / FSOCKOPEN / FGETS + more
include($file,$r+);

Protect against: native php XSS/User Defined Procedure Injection (i believe most hosts have url fopen turned off in php.ini by default)

 

fyi what i mean by user defined procedure injection is if you are pulling php code from a db to execute with exec() then someone could hijack the exec command and exec whatever they want, though this would be impossible anyway if you added the full domain url/path before using fopen/include etc functions

 

 

hope this helps,

 

edit--

well, using that heres what i'm doing, to clean EVERYTHING

 

foreach($_GET as $key => $stuff){
$_GET[$key] = htmlspecialchars(strip_tags(mysql_real_escape_string(stripslashes($stuff))));
}
foreach($_POST as $key => $stuff){
$_POST[$key] = htmlspecialchars(strip_tags(mysql_real_escape_string(stripslashes($stuff))));
}

For some reason reassigning the $_GET variable failed for me on several occasions, personally i would assign it to a different array name to be php compatible with the example.

 

 

[deadonarrival]

Would do the job, apart from getting rid of javascript: and a few other nasties.

 

Try the function above and preg_replace "javascript:" in $var with "javascript ". Then you can even clean up your code with it.

 

<?php
function clean($var)
{
/*
  * Use preg_replace to replace things such as javascript: and any other nasties you can think of. This is the bloated bit.
  * Done because things like javascript: aren't caught by strip_tags. I also remove certain javascript functions for good measure
  */

//Take out any slashes, in case php is set to add them
$var = stripslashes($var);
//Now add in our own slashes
$var = mysql_real_escape_string($var);
//Strip any html tags
$var = strip_tags($var);
//Convert any special chars
$var = htmlspecialchars($var);
}

foreach($_GET as $key => $stuff){
$_GET[$key] = clean($stuff);
}
foreach($_POST as $key => $stuff){
$_POST[$key] = clean($stuff);
}
?>

 

And if you ever want to add more functions, or remove some, or change the order, you just do it in one nice neat place.

[spikeon]

except it dosen't work....

 

it cleared everything from the get... what'd i do wrong?

[spikeon]

what surprises me is that you can assign a NEW $_GET

but is it possible that you can't edit an EXISTING get?

[uniflare]

personally on my php installation is i can MODIFY _GET Variables, not sure about _POST.

 

deadonarriavles code does not work because mysql_escape_string requires an active mysql connection.

[spikeon]

it fixed itself when i used correct syntax:

 

$_GET['$key']

[spikeon]

well, i DO have an active connection...

 

i think

'

i open it at the beginning of the page

[spikeon]

and, $_POST still dosen't work, $_GET did however,

[deadonarrival]

Did it work before?

 

Why not assign it to a new array

$get and $post instead of $_GET and $_POST

You can use it in in the same way, in the same places - but nicely cleaned.

[spikeon]

hmmm, perhaps

 

u see, i have this damn code spread over 20 files...

 

perhaps i have something that will find-replace in all of them

[deadonarrival]

www.context.cx

 

Just open the directory with the files in, then open them all (or a sub-directory at a time)

 

Find->replace

and select "all files"

[spikeon]

ah, i did that and now its not working......

[spikeon]

 

now, the question is:

 

why does GET work and POST not work?

 

foreach($_GET as $key => $stuff){
$_GET['$key'] = clean($stuff);
}
foreach($_POST as $key => $stuff){
$_POST['$key'] = clean($stuff);
}

 

 

[deadonarrival]

Because you can't set $_POST values, they have to be passed from a form.