News Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

Zend Developer Zone:
Avoiding XSS security attacks to sites that use HTML editors
March 27, 2007 @ 10:03:00

In an article from the Zend Developer Zone by Manuel Lemos, there's a look at how to avoid cross-site scripting security attacks on a site that allows users to input information via a HTML editor.

HTML editors are great. However, care must be taken to avoid security abuses. An application that uses HTML editors, expects that the submitted HTML content comes correctly formatted and well-formed. That happens when real users use real browsers to edit the content.

However, an attacker may create a program that pretends to be a real browser and submit specially crafted HTML with Javascript that may open security holes.

Manuel talks a bit about what cross-site scripting means in this context and a simple (Javascript) example of how a user could abuse it. His solution? Parse the incoming data (filter it!) and look for potentially harmful tag types. To do this, he recommends the PHP Input Filter class. There's even a simple example of how to use it included in the post.

0 comments voice your opinion now!
crosssitescripting htmleditor fckeditor xss inputfilter class crosssitescripting htmleditor fckeditor xss inputfilter class


blog comments powered by Disqus

Similar Posts

Hardened-PHP Project: WordPress Vulnerability Advisories (XSS & Trackbacks)

Pádraic Brady's Blog: XSS in PHP (Part 1): How Not to Use Htmlspecialchars

CodeIgniter Blog: CodeIgniter 1.6.3 Maintenance and Security Release

DevShed: Developing a Form Director Class

Zend Developer Zone: Avoiding XSS security attacks to sites that use HTML editors


Community Events

Don't see your event here?
Let us know!


release language podcast community list extension security voicesoftheelephpant introduction interview php7 version framework example series api laravel laravel5 library opinion

All content copyright, 2015 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework