Re: Echoing input w/o sanatizing - what is the danger

From: Date: Wed, 08 Aug 2007 03:43:38 +0000
Subject: Re: Echoing input w/o sanatizing - what is the danger
References: 1 2 3 4  Groups: php.general 
Request: Send a blank email to php-general+get-260408@lists.php.net to get a copy of this message
Daniel Brown wrote:
On 8/7/07, Richard Lynch <ceo@l-i-e.com> wrote:
On Tue, August 7, 2007 5:08 pm, Daniel Brown wrote:
It's actually not so much for echo'ing as it is for processing the data in another manner that makes it dangerous not to do some sanitizing and checking.... such as database manipulation.
This is wrong. Google for "cross site scripting attack" to get some sense of just how wrong this is. :-)
Under normal circumstances, Rich, you're exactly right. I know exactly what XSS is, thanks. However, in the context of this scenario, my point was valid. 
    So there!  ;-P
Why do i get the feeling that someone, some day, will be saying that ("So there! ;-P") to you? Again: http://phpsec.org/ b

« previous php.general (#260408) next »