Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -2 down vote favorite

In some tutorial i have read that we can filter meta characters and all that. I know all about that. in that tutorial there were written like this.

People who attack site with script, its basic format is like this.

alert("Hi") So the special characters, which are used are shown below. < > ( ) " /

so in that tutorial its written like this you can convert this character as per your input. Like

< = &bc < = &mb

and so on. Then how to convert this special characters like this what should i have to write in code?

share|improve this question
Probably better off on Stack Overflow – Leigh Feb 9 '12 at 10:35

closed as off topic by Rory Alsop♦ Feb 9 '12 at 18:25

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

2 Answers

up vote 0 down vote

It depends on the programming language you are using, but most of them will provide ready to use functions for that purpose.

For example, you can have a look at the "htmlspecialchars" function in PHP (see manual page)

share|improve this answer
Oh thanks a lot.. it will really help me. – Chintan Gurjar Feb 9 '12 at 9:29
up vote 0 down vote

xss is not limited to script tag injection

You can find a huge number of xss examples on ha.ckers.org - note that many of them don't include a < or > - I.e. if you only try to escape these characters you're still wide open.

share|improve this answer
hmmm so is there any global way to secure in your way ? i know there are many examples and people can also bypass even a best waf....so is there another way to secure? – Chintan Gurjar Feb 9 '12 at 11:39
I don't have a way, I'd recommend you use a framework to worry about if for you e.g. cakephp which, like probably all frameworks, provides a means of cleaning malicious markup or simply using php's filters – AD7six Feb 9 '12 at 12:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.