Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My app creates an PDF file and uses an user entered info. How can I avoid all attacks with PDF vector?

Will htmlspecialchars be enough?

I don't want to enable JavaScript in PDF.

share|improve this question
Hi. You'll need to provide more info as to what you are wanting to protect and how sensitive it is. You will never be able to avoid all attacks through a particular vector unless you remove the vector, so instead you need to look at appropriate controls and to answer this we need to know what your risk acceptance level is. – Rory Alsop Jan 20 '12 at 8:46
users will enter text data via web forms, then i will use this data for generating tables in PDF. – RusAlex Jan 20 '12 at 18:39

How are you generating your PDFs? Unless you are creating HTML markup and using a tool to convert that to PDF, htmlspecialchars won't be of any use to you. < and & are not special in PDF text content.

If you are using the PHP PDFlib functions like PDF_add_table_cell to put your text in the document, there is no need for any particular kind of escaping. Those functions take raw text without any characters being 'special'. Other than general-purpose input filtering to remove unwanted control characters, no string preparation steps should be necessary.

I'm not sure what attacks you're trying to avoid; the most common problem with PDF is embedded scripting malware, but unless you're deliberately putting script in (using eg PDF_create_action) there won't be any in your produced document.

There was a global-XSS vulnerability in the browser PDF plugin once that affected any site hosting a PDF; if you want to ensure protection from that for users with old plugins you can serve all your PDFs with Content-Disposition: attachment.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.