Html_Safe: excluded id/name attributes
| From: | Sven Fuchs | Date: | Mon, 03 Apr 2006 01:27:38 +0000 |
| Subject: | Html_Safe: excluded id/name attributes | ||
| Groups: | php.pear.general | ||
| Request: | Send a blank email to pear-general+get-23508@lists.php.net to get a copy of this message | ||
Html_Safe strips name and id attributes from HTML by default.
I'd like to know the reason for this. What kind of security problem is introduced by allowing id/name attributes in arbitrary HTML
(i.e. content submitted by untrusted users)?
I need to understand possible issues because I've been asked by a
customer to turn this particular setting/behaviour off in his
application - so being able to tell him about the consequences would be
nice.
Thanks in advance :)
--
Sven