Re: PHP File Upload Security Hole - Still No Fix?

Johan Andersson <johan@andersson.net> wrote: > In my case where I use it at most is in like guestbooks, walls etc., > where I don't want the user be able to use HTML. You have to do it anywhere that you're generating HTML, regardless of the source. The only time you don't is where the variable you're outputting deliberately contains HTML. Suppose you have a product catalogue. You output the description with echo $row['description'] or somesuch. This all works fine until one day someone comes along and adds a product called "guitar&amp; good condition". > Of course you can solve _that_ problem in another way with a simple regexp > (ie. /<[^>]*>/) to remove the html tags.. but that's another issue. That wouldn't work. You need to escape '&' entities too. Anyway, why re-do work which has already been done for you in the htmlentities() function? > And I just wonders why do you, Ribbens, use htmlentities() in case of building > up an URL. . ? I don't. Why do you think I do? > You might want to url encode a search query etc. but that's url_encode, > isn't it? Yes. An example is: echo '<a href="product.php?id=',htmlentities(urlencode($row['ID'])),'>'; (This is an excellent example of why I prefer H() and U() ;-) )