Re: The PHP filter class I'm working on (securiity)
| From: | Martin Zvarík | Date: | Sat, 14 Mar 2009 14:25:44 +0000 |
| Subject: | Re: The PHP filter class I'm working on (securiity) | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-290035@lists.php.net to get a copy of this message | ||
What's the point?
If user puts in a search input something like <script>alert('I am super hacker');</script>
And the website outputs:
You are searching for: <script>....</script>
then what? it shows an alert(), who cares?
I, as an owner of this website, don't mind AT ALL.
Aha, forget to mention the XSS on MySQL or inside comments right? Isn't mysql_real_escape_string(), strip_tags() enough?
Martin