Re: note 98360 added to function.htmlspecialchars-decode

I've been deleting your notes because you're referring to another note. While it doesn't mention so explicitly on the site (which I do understand is frustrating), we generally remove notes that refer to others because, if and when the other note is removed, the referring note becomes orphaned and confuses visitors who try to track down the elusive original. Your note below can stay, but I'll be editing it to not only remove your addressing us directly (which isn't useful to the note as a whole), as well as the reference to the original poster of the referred note. I'll rewrite it in such a way that it becomes an entry entirely of its own, so your contribution will add value to the site without risking adding confusion or clutter. Sound okay? On Thu, Jun 10, 2010 at 12:24, <pinkgothic@gmail.com> wrote: > [@Editors: If you are rejecting this comment, could you please let me know? I really figure it > helps to have this in the comments. If you disagree, just tell me, I'll stop trying to put it > there. :( I'd just like to know why you keep removing it.] > > If you're enticed by benharold at mac dot com's html escaping trick, keep in mind he > said: "Now, if your dealing with text that is a mixed bag (has HTML entities and non-HTML > entities) you're on your own." > > That means you should never trust user input with that particular ternary construct. > > Why? > > Well, consider someone sending > '&amp;<script>alert('XSS');</script>' to your PHP script: > > <?php > $var = "&amp;<script>alert('XSS');</script>"; > $var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var; > echo $var; > ?> > > Since '&amp;' decodes into '&', (htmlspecialchars_decode($var) == > $var) will be -false-, thus returning $var without that it's escaped. In consequence, the > script-tags are untouched, and you've just opened yourself to XSS. > > There is, unfortunately, no reliable way to determine whether HTML is escaped or not that does > not come with this caveat that I know of. Rather than try and catch the case 'I've already > encoded this', you are better off avoiding double-escaping by simply escaping the HTML as close > to the actual output as you can muster, e.g. in the view in an MVC development structure. > ---- > Server IP: 92.48.74.199 > Probable Submitter: 217.92.147.99 > ---- > Manual Page -- > http://www.php.net/manual/en/function.htmlspecialchars-decode.php > Edit        -- https://master.php.net/note/edit/98360 > Del: integrated  -- > https://master.php.net/note/delete/98360/integrated > Del: useless     -- > https://master.php.net/note/delete/98360/useless > Del: bad code    -- > https://master.php.net/note/delete/98360/bad+code > Del: spam        -- https://master.php.net/note/delete/98360/spam���T��^�} > &��؄l > Del: non-english -- X�t/�� > �8�8ꄓB�https://master.php.net/note/delete/98360/non-english > Del: in docs     -- > https://master.php.net/note/delete/98360/in+docs > Del: other reasons-- https://master.php.net/note/delete/98360 > Reject      -- https://master.php.net/note/reject/98360 > Search      -- https://master.php.net/manage/user-notes.php > > > -- > PHP Notes Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > -- </Daniel P. Brown> daniel.brown@parasane.net || danbrown@php.net http://www.parasane.net/ || http://www.pilotpig.net/ We now offer SAME-DAY SETUP on a new line of servers!