XSS Vulnerabilities and strip_tags

From: Date: Fri, 12 Mar 2004 15:23:34 +0000
Subject: XSS Vulnerabilities and strip_tags
Groups: php.general 
Request: Send a blank email to php-general+get-180263@lists.php.net to get a copy of this message
Is the general wisdom that using strip_tags on input is sufficient to protect against XSS vulnerabilities from that input? I have been doing some reading on it but haven't found anything that suggests a vulnerability that removing the tags in this way would not cure. Are there multi-level encodings that can get past strip_tags? I probably should also be doing a urldecode before strip_tags to get around any hex encodings, or does strip_tags handle that? Thanks for any info, -- Tom

« previous php.general (#180263) next »