Re: [RFC] Improve HTML escape
| From: | Lester Caine | Date: | Mon, 03 Feb 2014 23:22:01 +0000 |
| Subject: | Re: [RFC] Improve HTML escape | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72156@lists.php.net to get a copy of this message | ||
Yasuo Ohgaki wrote:
I'm lost here. OWASP suggests to escape at least & --> & < --> < --> > " --> "It may be that what you are asking for is a flag on htmlentities for 'OWASP' compliant option. Others would probably view that as not then being html5 compliant since html5 has it's own list of 'escaped' characters. One of the irritating things I find is 'unescaping' a string does not return the original string simply because the html5 rule has not been followed! A clean html5 result should be the default. Looking at the Rule 2 from the OWASP they are actually asking for every character below 256 to be escaped when used in an attribute! But the important thing here is 'untrusted' data, and sanitising any externally supplied data needs a little more care than simply trying to wrap it in htmlentities which I think is what Stas is saying? Personally I try to avoid any path where input can be processed direct back to output, filter the input, don't simply try and patch the output? -- Lester Caine - G8HFL ----------------------------- Contact - http://lsces.co.uk/wiki/?page=contact L.S.Caine Electronic Services - http://lsces.co.uk EnquirySolve - http://enquirysolve.com/ Model Engineers Digital Workshop - http://medw.co.uk Rainbow Digital Media - http://rainbowdigitalmedia.co.uk' --> ' ' not recommended because its not in the HTML spec(See: section 24.4.1) ' is in the XML and XHTML specs./ --> / forward slash is included as it helps end an HTML entityhttps://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content I'm not sure why you state "already violate this requirement".