Best way to protect your site from scripts.

Discussion in 'PHP' started by Cinta April, May 4, 2008.

  1. #1
    Hi thanks to the php experts in this forum for shedding light to php security but now, regarding scripts exploit if you have a name field someone can insert

    '><script language='JavaScript'>alert('boo!');</script><a b='

    your data will not be ruined, but when the page containing the name opens, you'll receive pop up window with the message boo. Harmless, but someone can insert this script like 100 times in the name field and the pop up windowwill appear 100 times so your page will be unviewable. How to block from this kind of exploits? Do we use pregmatch tosearch for scripts? Is there other types of scripts that does not contain the word scripts?
     
    Cinta April, May 4, 2008 IP
  2. geekos

    geekos Well-Known Member

    Messages:
    3,365
    Likes Received:
    50
    Best Answers:
    0
    Trophy Points:
    140
    #2
    geekos, May 4, 2008 IP
  3. uski

    uski Peon

    Messages:
    94
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #3
    I'd add that this may be more dangerous than what it looks at first sight.

    If you have any sort of authentication on your website, it is possible to steal the credentials of the user with the XSS attack, to manipulate some cookies, to change the content of the pages, ...

    So be very careful with that. The rule is: never use a content sent by the user without prior validation.
    This also includes content which should not be modified by the user but which COULD be (example: <input type="hidden" ...> fields in HTML forms).
     
    uski, May 4, 2008 IP
  4. Cinta April

    Cinta April Banned

    Messages:
    262
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #4
    do all such scripts contain the word script?
     
    Cinta April, May 4, 2008 IP
  5. uski

    uski Peon

    Messages:
    94
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #5
    This is not the way to go.
    You should not try to remove what you think is bad - you should allow only what you know is good.

    The best is to put all user input through htmlentities(...). That should protect you.
     
    uski, May 5, 2008 IP