Re: RFC: Implementing a core anti-XSS escaping class
| From: | Steve Clay | Date: | Wed, 19 Sep 2012 18:08:48 +0000 |
| Subject: | Re: RFC: Implementing a core anti-XSS escaping class | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-63168@lists.php.net to get a copy of this message | ||
On 9/19/12 1:48 PM, Pádraic Brady wrote:
<style> body { background-color: <? echo $e->escapeCss('white'); ?> } </style>Hmmm, the following is a valid value: "</style><script>alert('xss')" ...for both the content and font-family CSS properties. Gotta love HTML! What would escapeCss do with them? Do we need to wrap in escapeHtml? Steve -- http://www.mrclay.org/