Re: Preventing SQL Injection/ Cross Site Scripting
| From: | Chris Shiflett | Date: | Thu, 26 Apr 2007 00:19:28 +0000 |
| Subject: | Re: Preventing SQL Injection/ Cross Site Scripting | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-253816@lists.php.net to get a copy of this message | ||
Dotan Cohen wrote:
> It would be BBcode if anything. It may be the product of the
> lazy, but I feel more secure parsing it than [x]HTML.
BBCode is a pretty useless markup format. If you only want to allow /
interpret a small subset of HTML, you can use a simple approach like this:
http://shiflett.org/blog/2007/mar/allowing-html-and-preventing-xss
If you want to allow a larger subset, or you're just looking for a
packaged solution, try HTML Purifier:
http://htmlpurifier.org/
Hope that helps.
Chris
--
Chris Shiflett
http://shiflett.org/