Session SID and strip tags
| From: | Derick Rethans | Date: | Sun, 08 Feb 2004 19:33:40 +0000 |
| Subject: | Session SID and strip tags | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-7648@lists.php.net to get a copy of this message | ||
Hey,
while reading the session documentation today
(en/reference/session/reference.xml) I noticed the following:
To continue, <A HREF="nextpage.php?<?php echo strip_tags (SID)?>">click
here</A>
The strip_tags() is used when printing the SID in order to prevent XSS
related attacks.
What's the point of having the SID support < and > anyway and can't we
just do the 'strip_tags' internally. The usage of strip_tags() in the
example is now needed, but it looks, well, kinda strange that it is
needed.
regards,
Derick