note 45219 deleted from function.stripslashes by aidan
| From: | aidan@php.net | Date: | Mon, 30 Aug 2004 11:06:25 +0000 |
| Subject: | note 45219 deleted from function.stripslashes by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-75667@lists.php.net to get a copy of this message | ||
Note Submitter: flgr
----
daevid:
That's not enough. That way somebody could use " style="font-size: 120pt;"
"foo as his name to inject HTML attributes into your web pages which is a bad idea for forums
and so on.
I'd suggest being very careful with user input and thinking about whether it can contain
insecure meta characters before interpolating it into a template.