6 ms·
HTMLPurifier? That thing should only be used if you are accepting html as input (eg: wysiwyg). Just escape everything in the view layer (not in the DBAL. There
by Jebus 14y ago
HTMLPurifier? That thing should only be used if you are accepting html as input (eg: wysiwyg). Just escape everything in the view layer (not in the DBAL. There you only escape to avoid sql injection, not XSS!)
- elchief 14y agowhat if someone puts html in a plain old text field? your db should never contain xss material. some jackass will forget to escape it on display.
- Jebus 14y agoThe thing is, you can't just 'escape XSS'. You need to know exactly where the data is going to be used, and you can't know that when you store it (in fact, you could use the same data in many different places). There are infinite ways of doing XSS, so if you don't escape properly, you are still vulnerable. The view layer should escape everything by default. Then if you need a different filter, or disable escaping (for wysiwyg for instance), do it manually.
- elchief 14y agobut how often is someone's username <script>stealMahCookeez()</script> ?