note 29169 added to function.strip-tags
| From: | icon dot at dot linux dot dot dot duke dot dot dot edu at rack1 dot php dot net | Date: | Wed, 05 Feb 2003 02:35:41 +0000 |
| Subject: | note 29169 added to function.strip-tags | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-43436@lists.php.net to get a copy of this message | ||
So, what happens if I submit
<scr<script></script>ipt>alert(1)</scr<script></script>ipt>?
Your parsers will remove <script></script> and leave the "safe" html with:
<script>alert(1)</script>.
Mission accomplished.
--
http://www.php.net/manual/en/function.strip-tags.php
http://master.php.net/manage/user-notes.php?action=edit+29169
http://master.php.net/manage/user-notes.php?action=delete+29169
http://master.php.net/manage/user-notes.php?action=reject+29169