note 72493 deleted from function.strftime by derick
| From: | derick@php.net | Date: | Sun, 11 May 2008 14:01:10 +0000 |
| Subject: | note 72493 deleted from function.strftime by derick | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-139271@lists.php.net to get a copy of this message | ||
Note Submitter: judas dot iscariote at gmail dot com
----
Security notice:
You can end with a (probably unexpected) XSS if the $format parameter is user submitted data ;)
<?php
echo strftime("<script>alert('lol');</script>");
?>
PHP does not check if $format is a valid format, so the usual security precautions should be taken
here .