Re: strip_tags() and the recent CERT advisory....

On Thu, 3 Feb 2000, Martin Koistinen wrote: > Many thanks to tomjr (at) tx3 (dot) net for posting into the annotated PHP > manual a simple solution to the mis-named Cross-System Scripting Attacks > (http://www.cert.org/advisories/CA-2000-02.html). I was wondering if the > developers could modify strip_tags($str,$allowable_tags) to optionally > strip attributes from the allowable tags that are left unstripped. > > Also, the global solution like the one that tomjr has posted (thanks again) > is, unfortunately, somewhat CPU intensive, would there be any performance > gain to create some form of internal functionality to do the same? Perhaps > with a php.ini flag to toggle its use? Stripping tags is going to be CPU-intensive anyway you slice it. It's got to involve pattern matching, or at the very least string searching. It would be more efficient if it were built into the engine, and since PHP is a web-only type language, it may even make sense to include it in the engine itself. My solution can be thinned down depending on your situation, I wrote it to work for all cases, and makes it easy to separate into a file that can be easily included in multiple scripts. For example, if you aren't using cookies to generate any output, you can remove the HTTP_COOKIE_VARS loop entirely, which reduces CPU load due to that code by 1/3 :-) But, as you suggest, it would be real nice if PHP had a flag similiar to "track_vars" that could be used either in php.ini or in script, that would simply strip all tags from all input. If you want to allow certain tags but strip attributes, you -could- roll your own with preg_replace... --------------------------------------------------------------- | Tom Greer Jr | Phone (360)825-7225 | | System Operator | http://www.tx3.net/ | | Tx3 Online Services | email tomjr@tx3.net | ---------------------------------------------------------------