Re: JavaScript Injection ???
| From: | Daniel Brown | Date: | Mon, 25 Apr 2011 23:45:58 +0000 |
| Subject: | Re: JavaScript Injection ??? | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-312487@lists.php.net to get a copy of this message | ||
On Mon, Apr 25, 2011 at 19:12, Nathan Rixham <nrixham@gmail.com> wrote:
>
> It is the browser, chrome will prevent execution because the code was sent
> in the request, just check the javascript console and you'll see something
> like:
>
> "Refused to execute a JavaScript script. Source code of script found within
> request."
Easy way to get around that, depending on where it lied and how it
was stored and accessed, is to inject it into the session. Chrome
would obviously have no notion of session data. An added step, but
proof positive that ALL data needs to be sanitized, not just GPC and
database.
--
</Daniel P. Brown>
Network Infrastructure Manager
http://www.php.net/