Can I protect my site excluding XSS and Sql injection?

Question

So, members of my site can post topics, reply, comment, edit them, etc. I always use htmlspecialcharsand addslashesfor html inputs to protect my website against XSS and SQL injection attacks. Is there enough or is there something else that I missed?
Thank.

Answer 1

A lot of things can go wrong in a web application. In addition to XSS and SQLi, there are:

• CSRF - Cross-Site Request Forgery
• LFI / RFI - local file inclusion / remote file called include(), require()...
• Enabling CRLF in mail()
• . , register_globals, extract(), import_request_variables()
• : fopen(), file_get_contents(), file_put_conents()
• eval() preg_replace() /e
• passthru(), exec(), system() ``

" " , OWASP Top 10, - .

Scarlet - , , .

, Wordpress. CWE, , -.

Answer 2

(. PDO), SQL-. htmlspecialchars() XSS.

:

http://phpsec.org/projects/guide/

http://cwe.mitre.org/top25/#Listing

http://www.owasp.org/index.php/Top_10_2010-Main

Answer 3

SQL- escape, , , PostGreSQL pg_escape_string, , . mysql_real_escape_string.

Answer 4

mysql_real_escape_string() SQL, addlashes. (, MySQL)

Answer 5

. PDO , mysql_real_espace_string.

, , , htmlentities.

Answer 6

SQL-:

• addlashes mysql_real_escape_string . . . , - .

• . / . ( - script)

XSS:

Do not allow users to use HTML.
To prevent this, you can use both strip_tags()(without permitted tags) and htmlspecialchars().
If you want to allow some markup, consider using BB code.

CSRF:

Any significant form must contain a unique token, which should be compared with the one stored in the session.