Skip to main content
16 events
when toggle format what by license comment
May 11, 2017 at 18:59 comment added Mike Brant It would be used in both those cases. In either case you have a string in a variable that may or may not have bad content in it.
May 11, 2017 at 18:40 comment added Tania Rascia @MikeBrant No problem. Would I use htmlspecialchars() function on the inserting or receiving page? So, input value="<?php echo htmlspecialchars($_POST[]); ?>" or <td><?php echo htmlspecialchars($row[]); ?></td> ?
May 11, 2017 at 18:33 comment added Mike Brant @TaniaRascia Sorry for confusion in comments. I meant that displaying information from database to a webpage opens the opportunities for XSS. If you are just collecting data into a database and never rendering it out to web page, there is no XSS vulnerability.
May 11, 2017 at 18:16 comment added Tania Rascia Additionally in this guide to preventing XSS.
May 11, 2017 at 18:13 comment added Tania Rascia @MikeBrant Read here, found in the PHP docs. I'm just confused as to how it could be an XSS vulnerability. Obviously I don't want to use it if that's the case, but I haven't found anything to support that.
May 11, 2017 at 18:05 comment added Mike Brant @TaniaRascia It would be useless in the sense of having your own named function. If all your function does is call htmlspecialChars() why do you need it?
May 11, 2017 at 16:41 comment added Tania Rascia @MikeBrant the function I made would be useless? I read about it on this article about preventing XSS attacks, so now I'm confused.
May 11, 2017 at 15:12 comment added Mike Brant @TaniaRascia Yes, you would use htmlspecialchars() for that. Your function does nothing other than that, so it probably should not exist. This would also introduce you to potential XSS vulnerability.
May 11, 2017 at 14:54 comment added Tania Rascia @MikeBrant if I were to, for example, print out the information in an HTML table on the front end, I would use the escape function I created, correct?
May 11, 2017 at 13:48 comment added Mike Brant @200_success I simply said that prepared statements don't sanitize against XSS attacks. I did not suggest that this is applicable to this use case, as we simply don't know how and if the information stored in the database is being rendered back out into pages on the site. If the answer achieved nothing other than getting OP to perform a Google search on XSS so they are aware of what it is for future use cases, then I am happy to help raise that awareness.
May 10, 2017 at 21:11 comment added Tania Rascia Thanks @200_success, I wanted to avoid the issue of putting a bunch of escapes and sanitization in places they don't belong.
May 10, 2017 at 20:52 comment added 200_success I don't see why htmlspecialchars() should not be considered an escaping function.
May 10, 2017 at 20:51 comment added 200_success Downvoted for confusing a beginner by suggesting that protecting against XSS is necessary. That is the kind of FUD that leads beginners to apply all kinds of escapes just in case. There is no XSS problem here, and nothing should be done to guard against it.
May 10, 2017 at 20:22 comment added Mike Brant filter_var(), filter_input(), filter_input_array() would all be good options.
May 10, 2017 at 20:17 comment added Tania Rascia Thanks! I do know I should be doing some JavaScript side validation, but I wanted to make sure the security aspect from the PHP end was secure first. So, are you saying I should change $_POST['email'] to filter_var($_POST['email'], FILTER_SANITIZE_EMAIL), for example? Thanks for the information, all very useful and informative.
May 10, 2017 at 20:06 history answered Mike Brant CC BY-SA 3.0