Geek Answers Handbook

Input - URL, how to protect it from xss

I have a form text field that accepts a url. When the form is submitted, I insert this field into the database with the proper anti-sql injection. My question though is about xss.

This input field is a url and I need to display it again on the page. How to protect it from xss on the way to the database (I think nothing is needed since I already took care of the SQL injection) and on the way from the database?

Suppose we have this, I simplify this, and please do not worry about SQL injection. Where will I go from here after this?

$url = $_POST['url'];

thanks

+5
source share
3 answers

, HTML (, <body> </body> <div> </div>), 5 XML (&, <, > , ", '), OWASP (/). PHP htmlentities() , str_replace() :

function makeHTMLSafe($string) {
    $string = htmlentities($string, ENT_QUOTES, 'UTF-8');
    $string = str_replace('/', '&#x2F;', $string);
    return $string;
}

, , tainted HTML, href= <a, ([ ]% * +, -/; <= > ^ |) - HTML:

function makeHTMLAttributeSafe($string) {
    $scaryCharacters = array(32, 37, 42, 43, 44, 45, 47, 59, 60, 61, 62, 94, 124);
    $translationTable = array();
    foreach ($scaryCharacters as $num) {
        $hex = str_pad(dechex($num), 2, '0', STR_PAD_LEFT);
        $translationTable[chr($num)] = '&#x' . $hex . ';';
    }

    $string = strtr($string, $translationTable);
    return $string;
}

- UTF-8 - UTF-8 HTML. , , UTF-8, , :

function assertValidUTF8($string) {
    if (strlen($string) AND !preg_match('/^.{1}/us', $string)) {
        die;
    }

    return $string;
}

u Unicode. chararchter, ., , Unicode.

, - . , .

OWASP XSS.

+9

htmlspecialchars . <script> / HTML-.

+1

XSS-, , - ( XSS-demopage, : Broken IMG-tags, ..).

, sseq-lib .

: XSS-demopage.

+1

More articles:


All Articles