Re: Re: The PHP filter class I'm working on (securiity)

Jochem Maas wrote: > Martin Zvarík schreef: >> What's the point? >> >> If user puts in a search input something like <script>alert('I am super >> hacker');</script> >> >> And the website outputs: >> You are searching for: <script>....</script> >> >> then what? it shows an alert(), who cares? > > replace the alert() with some code that passes the cookie to a hacker controlled > domain. now create a URL that includes the given javascript: > > echo > 'http://mzvarik.com/foo?somevar='.urlencode('<script > type="text/javascript">/*evil code here*/</script>'); > > send url to unsuspecting users of your site. anyone know clicks the URL > has just had their cookies hijacked. > > still don't mind? > >> I, as an owner of this website, don't mind AT ALL. >> >> Aha, forget to mention the XSS on MySQL or inside comments right? Isn't >> mysql_real_escape_string(), strip_tags() enough? >> >> Martin >> > A little off topic, but I was testing some exploits like this on my dev box and no matter what I did all quotes in the URL were escaped with \ even if I urlencoded the quotes (single or double). I have magic_quotes_gpc = on but I wouldn't think this would escape urlencoded quotes. Is it the suhosin patch maybe or something elese? -- Thanks! -Shawn http://www.spidean.com