I have an admin panel that is running off a mysql db. On that panel, I have text boxes that allow an "Admin" to input plain text OR HTML Styling that will be displayed on a section of the site that is live. So for example, A user might input the following in a Title textbox;
<b>The 'Rory' jumped over the moon</b>
The text boxes are set to only allow specific html syntax.
Does that prevent a web shell from being dropped on to the web server through the text boxes?
- Is there a way to bypass the filtering?
- If you manipulated the data in the DB, would it allow php to run?