Geek Answers Handbook

Download executable code via <img> or <a> tags?

I am working on an application that will allow people to enter an arbitrary URL to be included in <a href="ARBITRARY URL">and tags <img src="ARBITRARY URL" />.

What types of security risks are I viewing?

The application is encoded in PHP, and the only security measure I am currently implementing is PHP htmlentities () against the input URL before sending it as HTML. I also check that the text of the URL starts with http://or https://, but I do not know if this has achieved anything, security.

What else should I do to ensure the safety of my end users?

+5
source share
7 answers

See the XSS Checklist .

+3
source

Would you like to read about XSS (cross-site scripting) and XSRF (fake cross-site request)

EDIT: As ryeguy pointed out , you can pretty much copy and paste any of the examples into the XSS (Cross Site Scripting) Cheat Sheet and look for the best way to prevent them accordingly.

+2
source

, img

+2

, javascript, . . http://www.thinkfu.com/blog/?p=15

SVG (mime-type image/svg + xml) javascript. . http://www.w3.org/TR/SVG/interact.html

+2

, URL-, . , - - , , , - .

, , ? .

+1

CSRF:

<img src="http://example.org/accounts/123/delete" />
+1

, - xss , onmouseover onhover .. - javascript, - .

0
source

More articles:


All Articles