Re: Question about a security function
| From: | David Otton | Date: | Thu, 20 May 2010 13:27:26 +0000 |
| Subject: | Re: Question about a security function | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-305353@lists.php.net to get a copy of this message | ||
On 20 May 2010 13:53, Al <news@ridersite.org> wrote:
>
> I have a password-protected, user, on-line editor that I'm hardening against
> hackers just in case a user's pw is stolen or local PC is infected.
>
> The user can enter html tags; but, I restrict the acceptable tags to benign
> ones. e.g., <p>, <b>, <table>, etc. e.g., no <embed... <script...
> etc.
>
> Just to be extra safe, I've added a function that parses for executables in
> the raw, entered text. If found, I post and nasty error message and ignore
> the entry altogether.
That's not really going to work. See:
http://ha.ckers.org/xss.html
Blacklisting is a fundamentally flawed approach. I suggest using
http://htmlpurifier.org/ instead.