Re: Filtering _REQUEST.. Why is this bad?
| From: | Chris Shiflett | Date: | Tue, 13 Feb 2007 03:12:04 +0000 |
| Subject: | Re: Filtering _REQUEST.. Why is this bad? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-248795@lists.php.net to get a copy of this message | ||
Travis Doherty wrote:
> Why is this so bad?
>
> <?php
> // blindly run everything in _REQUEST through htmlentities
1. That's escaping, not filtering.
2. http://shiflett.org/archive/178
3. Using $_REQUEST is sloppy and makes CSRF attacks easier.
Maybe more? This is bad for all the reasons magic_quotes_gpc is bad...
Chris
--
Chris Shiflett
http://shiflett.org/