Tag Info

New answers tagged

0

I'd rather use JSON instead of XML. It is easier to understand how the parser works and so the security risks are much lower. For example you have to turn off loading external entities with libxml_disable_entity_loader(true) if you don't want an XXE attack, and so on. The other part of the question is the generation of HTML, SVG etc. in the browser. For ...


0

It's hard to say, if above code is fully secured, as you didn't provide us the definition of xml_encode function. Basing on your input/output samples, it looks, that xml_encode is similar to htmlspecialchars which could be used to sanitize your XML data too. If I were you, I'd decide to use htmlspecialchars with correct flags (ENT_QUOTES) or libraries for ...


0

The encode() method HTML encodes characters, which is the correct XSS prevention method in this context. So if a " character was inserted inside of $str to try and break out of the HTML attribute context, this would be converted to " or " which is the HTML representation. Therefore it is not possible to inject script here, assuming encode ...


-1

If the web site is doing no escaping, validation, or character substitutions, the trivial XSS attack is just: " /> < script> alert('pawned') < / script> Which is why every web site should be doing escaping, validation, and substituting or removing dangerous characters.


3

The OWASP XSS Experimental Minimal Encoding Rules suggest that all that needs to be encoded are <, & and >, as long as the charset is specified. Assuming the second page outputs within an HTML context, then there doesn't seem to be an XSS attack vector in this case. Setting charset and then encoding your POST will simply mean that the server will ...



Top 50 recent answers are included