Will htmlspecialchars (php) be enough for making secure PDF files with user entered data?

Question

My app creates an PDF file and uses an user entered info. How can I avoid all attacks with PDF vector?

Will htmlspecialchars be enough?

I don't want to enable JavaScript in PDF.

Answer 1

How are you generating your PDFs? Unless you are creating HTML markup and using a tool to convert that to PDF, htmlspecialchars won't be of any use to you. < and & are not special in PDF text content.

If you are using the PHP PDFlib functions like PDF_add_table_cell to put your text in the document, there is no need for any particular kind of escaping. Those functions take raw text without any characters being 'special'. Other than general-purpose input filtering to remove unwanted control characters, no string preparation steps should be necessary.

I'm not sure what attacks you're trying to avoid; the most common problem with PDF is embedded scripting malware, but unless you're deliberately putting script in (using eg PDF_create_action) there won't be any in your produced document.

There was a global-XSS vulnerability in the browser PDF plugin once that affected any site hosting a PDF; if you want to ensure protection from that for users with old plugins you can serve all your PDFs with Content-Disposition: attachment.