php - Is htmlspecialchars() used for all applications when suspect content is put on a page? -
i understand should use htmlspecialchars() when displaying user provided content html on page. apply other content such javascript, css, value of <input>, etc? believe have heard use json_encode() instead of htmlspecialchars() encode js.
<?php $dangerous=$_get['dangerous']; session_start(); $_session['mysession']=$dangerous; ?> <!doctype html public "-//w3c//dtd xhtml 1.0 transitional//en" "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title><?php echo($dangerous);?></title> <style type="text/css"> div.<?php echo($dangerous);?> {size:12px;} </style> <script type="text/javascript"> var myvar=<?php echo($dangerous);?>; </script> </head> <body> echo(<?php echo($dangerous);?>) <input type="text" value="<?php echo($dangerous);?>" class="whatever" name="myinput" /> <a href="<?php echo($dangerous);?>">some link</a> </body> </html>
i understand should use htmlspecialchars() when displaying user provided content html on page. apply other content such javascript, css, value of
<input>, etc?
err… sort of.
first, assumes intending accept text (which represent html). if accepting html need use different approach sanitising (this involves using real html parser , whitelist of acceptable elements , attributes, , possibly additional checking of attribute values).
if carry of assumption working text…
the value of input element provided html attribute. html attributes contain html need represent special characters inside value entities.
css , javascript not html, need use appropriate escaping target language. however, embed (presumably) css or javascript html document.
if putting in attribute value, need escape normal.
if putting <script> or <style> element, have deal special handling rules in html. elements defined containing cdata (if put in html 4 terms) thing have watch out presence of </script> or </style> in data.
if dealing xhtml (and suggest don't) have jump through usual hoops described in the media types note.
Comments
Post a Comment