note 99896 added to function.htmlentities
| From: | SijmenRuwhof at osu1 dot php dot net | Date: | Mon, 13 Sep 2010 19:18:04 +0000 |
| Subject: | note 99896 added to function.htmlentities | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-172522@lists.php.net to get a copy of this message | ||
An important note below about using this function to secure your application against Cross Site
Scripting (XSS) vulnerabilities.
When printing user input in an attribute of an HTML tag, the default configuration of htmlEntities()
doesn't protect you against XSS, when using single quotes to define the border of the
tag's attribute-value. XSS is then possible by injecting a single quote:
<?php
$_GET['a'] = "#000' onload='alert(document.cookie)";
?>
XSS possible (insecure):
<?php
$href = htmlEntities($_GET['a']);
print "<body bgcolor='$href'>"; # results in: <body
bgcolor='#000' onload='alert(document.cookie)'>
?>
Use the 'ENT_QUOTES' quote style option, to ensure no XSS is possible and your application
is secure:
<?php
$href = htmlEntities($_GET['a'], ENT_QUOTES);
print "<body bgcolor='$href'>"; # results in: <body
bgcolor='#000' onload='alert(document.cookie)'>
?>
The 'ENT_QUOTES' option doesn't protect you against javascript evaluation in certain
tag's attributes, like the 'href' attribute of the 'a' tag. When clicked on
the link below, the given JavaScript will get executed:
<?php
$_GET['a'] = 'javascript:alert(document.cookie)';
$href = htmlEntities($_GET['a'], ENT_QUOTES);
print "<a href='$href'>link</a>"; # results in: <a
href='javascript:alert(document.cookie)'>link</a>
?>
----
Server IP: 83.137.20.135
Probable Submitter: 77.251.103.61
----
Manual Page -- http://www.php.net/manual/en/function.htmlentities.php
Edit -- https://master.php.net/note/edit/99896
Del: integrated -- https://master.php.net/note/delete/99896/integrated
Del: useless -- https://master.php.net/note/delete/99896/useless
Del: bad code -- https://master.php.net/note/delete/99896/bad+code
Del: spam -- https://master.php.net/note/delete/99896/spam
Del: non-english -- https://master.php.net/note/delete/99896/non-english
Del: in docs -- https://master.php.net/note/delete/99896/in+docs
Del: other reasons-- https://master.php.net/note/delete/99896
Reject -- https://master.php.net/note/reject/99896
Search -- https://master.php.net/manage/user-notes.php