XSS Vulnerabilities and strip_tags
| From: | trlists at clayst dot com | Date: | Fri, 12 Mar 2004 15:23:34 +0000 |
| Subject: | XSS Vulnerabilities and strip_tags | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-180263@lists.php.net to get a copy of this message | ||
Is the general wisdom that using strip_tags on input is sufficient to
protect against XSS vulnerabilities from that input? I have been doing
some reading on it but haven't found anything that suggests a
vulnerability that removing the tags in this way would not cure.
Are there multi-level encodings that can get past strip_tags?
I probably should also be doing a urldecode before strip_tags to get
around any hex encodings, or does strip_tags handle that?
Thanks for any info,
--
Tom