RE: [PHP] Preventing XSS Attacks
| From: | HallMarc Websites | Date: | Thu, 11 Jun 2009 14:57:38 +0000 |
| Subject: | RE: [PHP] Preventing XSS Attacks | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-293933@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> From: tedd [mailto:tedd.sperling@gmail.com]
> Sent: Thursday, June 11, 2009 9:28 AM
> To: PHP-General List
> Subject: Re: [PHP] Preventing XSS Attacks
>
> At 7:08 PM +0100 6/10/09, Ashley Sheridan wrote:
> >
> >So something like this would be acceptable?:
> >
> >$searchTerms = (isset($_REQUEST['q']))?$_REQUEST['q']:'';
> >$searchTerms = htmlentities($searchTerms);
> >$dbSearchTerms = mysql_real_escape_string($searchTerms);
> >
> >Giving me two variables, one for display output to user, the other for
> >use in the database?
> >
> >Thanks
> >Ash
>
> Ash:
>
> I wouldn't use $_REQUEST. If you know the request method then use it.
>
> There can be problems using $_REQUEST.
>
> Cheers,
>
> tedd
>
> --
> -------
> http://sperling.com
> http://ancientstones.com
> http://earthstones.com
>
I agree with tedd whole heartedly and I want to repeat the importance of
protecting the data coming back from the db as well by using
safeEscapeString in your queries and again the reason for this is to prevent
malicious code from being executed.
As far as CSRF/XSRF take a read here
http://shiflett.org/articles/cross-site-request-forgeries
[Marc Hall - HallMarc Websites - http://www.hallmarcwebsites.com
610.446.3346]