Timeline for Inserting users using PDO prepared statements
Current License: CC BY-SA 3.0
16 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
May 11, 2017 at 18:59 | comment | added | Mike Brant | It would be used in both those cases. In either case you have a string in a variable that may or may not have bad content in it. | |
May 11, 2017 at 18:40 | comment | added | Tania Rascia |
@MikeBrant No problem. Would I use htmlspecialchars() function on the inserting or receiving page? So, input value="<?php echo htmlspecialchars($_POST[]); ?>" or <td><?php echo htmlspecialchars($row[]); ?></td> ?
|
|
May 11, 2017 at 18:33 | comment | added | Mike Brant | @TaniaRascia Sorry for confusion in comments. I meant that displaying information from database to a webpage opens the opportunities for XSS. If you are just collecting data into a database and never rendering it out to web page, there is no XSS vulnerability. | |
May 11, 2017 at 18:16 | comment | added | Tania Rascia | Additionally in this guide to preventing XSS. | |
May 11, 2017 at 18:13 | comment | added | Tania Rascia | @MikeBrant Read here, found in the PHP docs. I'm just confused as to how it could be an XSS vulnerability. Obviously I don't want to use it if that's the case, but I haven't found anything to support that. | |
May 11, 2017 at 18:05 | comment | added | Mike Brant |
@TaniaRascia It would be useless in the sense of having your own named function. If all your function does is call htmlspecialChars() why do you need it?
|
|
May 11, 2017 at 16:41 | comment | added | Tania Rascia | @MikeBrant the function I made would be useless? I read about it on this article about preventing XSS attacks, so now I'm confused. | |
May 11, 2017 at 15:12 | comment | added | Mike Brant |
@TaniaRascia Yes, you would use htmlspecialchars() for that. Your function does nothing other than that, so it probably should not exist. This would also introduce you to potential XSS vulnerability.
|
|
May 11, 2017 at 14:54 | comment | added | Tania Rascia | @MikeBrant if I were to, for example, print out the information in an HTML table on the front end, I would use the escape function I created, correct? | |
May 11, 2017 at 13:48 | comment | added | Mike Brant | @200_success I simply said that prepared statements don't sanitize against XSS attacks. I did not suggest that this is applicable to this use case, as we simply don't know how and if the information stored in the database is being rendered back out into pages on the site. If the answer achieved nothing other than getting OP to perform a Google search on XSS so they are aware of what it is for future use cases, then I am happy to help raise that awareness. | |
May 10, 2017 at 21:11 | comment | added | Tania Rascia | Thanks @200_success, I wanted to avoid the issue of putting a bunch of escapes and sanitization in places they don't belong. | |
May 10, 2017 at 20:52 | comment | added | 200_success |
I don't see why htmlspecialchars() should not be considered an escaping function.
|
|
May 10, 2017 at 20:51 | comment | added | 200_success | Downvoted for confusing a beginner by suggesting that protecting against XSS is necessary. That is the kind of FUD that leads beginners to apply all kinds of escapes just in case. There is no XSS problem here, and nothing should be done to guard against it. | |
May 10, 2017 at 20:22 | comment | added | Mike Brant |
filter_var() , filter_input() , filter_input_array() would all be good options.
|
|
May 10, 2017 at 20:17 | comment | added | Tania Rascia |
Thanks! I do know I should be doing some JavaScript side validation, but I wanted to make sure the security aspect from the PHP end was secure first. So, are you saying I should change $_POST['email'] to filter_var($_POST['email'], FILTER_SANITIZE_EMAIL) , for example? Thanks for the information, all very useful and informative.
|
|
May 10, 2017 at 20:06 | history | answered | Mike Brant | CC BY-SA 3.0 |