XSS Problem

Security issues related to php and mysql usage. How to make your code secure? Security measures and configurations? It's all in here!

Moderators: egami, macek, gesf

Post Reply
php-forum GURU
php-forum GURU
Posts: 215
Joined: Wed Dec 07, 2011 5:25 pm

Sat Jan 21, 2012 3:36 pm

Of course it depends on situation(in ex: of vulnerability)
But i think if you encode that characters: in ex: htmlentities($data)
& will become &amp
< will become as < > > etc.
It depends on you how your script pulls it back to user.(if it is htmlentiti'ed) it is safe from XSS and user browser will not render it as it displayed on user browser:
In ex:

Code: Select all

echo $data;
It is safe for now: <script>alert(document.cookie);</script>

WIth SQL iinjections:
Here is my custom function:D

Code: Select all

define ("INTERNAL","antisqlinjectionmodule");
function sanitize(&$string,$die=1)

if (empty($string))@header("Location: index.php");
foreach ($blacklisted as $black)
{if ($die==0){
if(strlen(str_ireplace($black,'',$string)) !==strlen($dummy) || strlen($string)==0)@header("Location: " . "/index.php");
$string=str_ireplace($black,'',$string); //sanitization
pass your string to this function by refenrence and that all it will sanitize it to you)
And it is a bit safer than using preg_* functions (theris a minimal chance to bypass that filtering)
Also use mysql_real_escape_string() when you are going to deal with MYSQL QUERIES.
If you expect to get int force it to be int
This is a just example.

Code: Select all

echo $maycomefromhacker;
Output: -999 (We prevented that malicious request using this way)
I would like to say again it depends on situation how to handle and secure your application.
Never Trust To CLient Side! Thats all)
Post Reply