What happens if someone enters a PHP snippet into <style> tags?

Discussion in 'PHP' started by mnymkr, Mar 4, 2007.

0
  1. #1
    I am toying with this idea of letting my users change some CSS on their profiles. 

    <?php if($user->profile_css): ?>
<style type="text/css"> <?php print ($user->profile_css) ?></style>
<?php endif ?>
    Code (markup):
    Basically I have created a field that is inserted into the style tags with php. What happens if someone enters php into this field instead of CSS.
     
    mnymkr, Mar 4, 2007 IP
  2. MrX

    MrX Well-Known Member

    Messages:
    1,563
    Likes Received:
    77
    Best Answers:
    0
    Trophy Points:
    140
    #2
    The php gets executed before anything is sent to the browser, so the browser would just see

    <style type="text/css">whatever your php printed in here</style>
    Code (markup):
     
    MrX, Mar 4, 2007 IP
  3. mnymkr

    mnymkr Well-Known Member

    Messages:
    2,328
    Likes Received:
    32
    Best Answers:
    0
    Trophy Points:
    120
    #3
    yes , but what if they put a php script in there that could mess up the page or call soemthign from somwhere else or try to access my db
     
    mnymkr, Mar 4, 2007 IP
  4. MrX

    MrX Well-Known Member

    Messages:
    1,563
    Likes Received:
    77
    Best Answers:
    0
    Trophy Points:
    140
    #4
    It wouldn't get executed. It would be like putting

    <style><? echo "asdfasdf" ?></style>
    Code (markup):
    in an HTML file. Nothing would happen.
     
    MrX, Mar 4, 2007 IP
  5. Jim_

    Jim_ Peon

    Messages:
    72
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    0
    #5
    If you were to allow users to have a CSS section in their profile, you would need to make sure you clean it by stripping out any HTML tags and removing any instances of the text 'javascript:' as some browsers allow JavaScript to be executed inside stylesheets.

    The easiest way to accomplish this would be to replace <?php print ($user->profile_css) ?> with <?php print eregi_replace("javascript:","",strip_tags($user->profile_css)); ?>
     
    Jim_, Mar 4, 2007 IP
  6. Icheb

    Icheb Peon

    Messages:
    1,092
    Likes Received:
    31
    Best Answers:
    0
    Trophy Points:
    0
    #6
    You are using a regular expression to remove a string? Man I so don't want to see the rest of your code.
     
    Icheb, Mar 4, 2007 IP
  7. Jim_

    Jim_ Peon

    Messages:
    72
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    0
    #7
    str_ireplace would probably be better. I just couldn't think of a non-case sensitive version of str_replace at the time.

    Your social grace amazes me.
     
    Jim_, Mar 5, 2007 IP
    MrX likes this.
  8. mnymkr

    mnymkr Well-Known Member

    Messages:
    2,328
    Likes Received:
    32
    Best Answers:
    0
    Trophy Points:
    120
    #8

    what do you mean by regular expression?

    what should the code be so I can put it in correctly.
     
    mnymkr, Mar 5, 2007 IP
  9. Jim_

    Jim_ Peon

    Messages:
    72
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    0
    #9
    Regular expressions are used for finding strings based on patterns and rules. Icheb complained about my use of the eregi_replace function, which uses regular expressions, because it uses a bit more processing power.

    The following code should work fine.
    <?php print str_ireplace("javascript:","",strip_tags($user->profile_css)); ?>

    This snippet of code removes any html tags and removes any occurrence of the string 'javascript:' from the data and then prints it.

    It would probably be a good idea to clean the string of tags and such before storing it in the database, rather than clean it every time you pull it out of the database to save processing time.
     
    Jim_, Mar 5, 2007 IP