Re: [PHP4BETA] Re: strip_tags() and the recent CERT advisory....

On Thu, 3 Feb 2000, Stanislav Malyshev wrote: > TG>> My solution can be thinned down depending on your situation, I wrote it to > TG>> work for all cases, and makes it easy to separate into a file that can be > TG>> easily included in multiple scripts. For example, if you aren't using > TG>> cookies to generate any output, you can remove the HTTP_COOKIE_VARS loop > TG>> entirely, which reduces CPU load due to that code by 1/3 :-) > > Well, in fact if you wanted to disable HTML entirely, won't > htmlentities() have the same effect and be faster? So you'll still see > those tags, but they will be harmless... Or I still miss something > important? In looking at the PHP source code, it does appear that htmlentities() would be more CPU efficient than strip_tags(). It just uses memcpy() and erealloc() to expand the size of the string and move things around while escaping. The strip_tags() uses a state machine with lots of conditional tests in it, and calls to other internal functions in addition to using memcpy(). But I'm not about to benchmark them :-) If anyone wants to do that and post results, I'd be interested. However, htmlentities() only works with ISO-8859-1 character set. If the browser in question is submitting data to the script in another character set, htmlentities() does nothing to it, or worse, the wrong thing (because it assumes its ISO-8859-1 even if it is not). If someone using a localized browser in another country wanted to attack your script users, he might be able to take advantage of that assumption and wreak havoc (and the whole point of this excerise is to eliminate a problem, not trade it for another one). --------------------------------------------------------------- | Tom Greer Jr | Phone (360)825-7225 | | System Operator | http://www.tx3.net/ | | Tx3 Online Services | email tomjr@tx3.net | ---------------------------------------------------------------