Re: Preventing Cross Site Scripting Vulnerbilities
| From: | Michael B Allen | Date: | Thu, 08 Dec 2005 18:23:15 +0000 |
| Subject: | Re: Preventing Cross Site Scripting Vulnerbilities | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-227153@lists.php.net to get a copy of this message | ||
On Wed, 07 Dec 2005 14:33:07 -0500
Chris Shiflett <shiflett@php.net> wrote:
> Michael B Allen wrote:
> > Can someone recommend a general method for avoiding / eliminating XSS
> > vulnerbilities with PHP?
>
> Yeah, escape output. It's really that simple.
Well after looking at this for a while I agree that makes the most
sense. It's a little unnerving to let scripts find their way into the
database but with in combination with strong validation that can be
minimized and in many cases eliminated.
Mike