note 104114 deleted from function.htmlentities by danbrown
| From: | danbrown@php.net | Date: | Tue, 24 May 2011 13:01:11 +0000 |
| Subject: | note 104114 deleted from function.htmlentities by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-179998@lists.php.net to get a copy of this message | ||
Note Submitter: portalpress dot org at gmail dot com
----
In addition to Sijmen Ruwhof 13-Sep-2010 07:18 about Cross Site Scripting (XSS) vulnerabilities.
Just use :
function XSShtmlentities($string) {
$XSSarray=array(
" " => " ",
"!" => "!",
"%" => "%",
"(" => "(",
")" => ")",
"*" => "*",
"+" => "+",
"," => ",",
"-" => "-",
"." => ".",
":" => ":",
"=" => "=",
"?" => "?",
"@" => "@",
"{" => "{",
"|" => "|",
"}" => "}",
"~" => "~");
return(strtr(htmlentities($string,ENT_QUOTES),$XSSarray));
}
The array is a bit over the top, but surely XSS-safe.