918 reputation
716
bio website php100.wordpress.com
location San Jose, CA
age 40
visits member for 4 years
seen Dec 4 at 22:16
Programmer (Unix, Windows, C, C++, PHP, etc.)

Dec
11
awarded  Yearling
Sep
3
awarded  Good Question
Aug
28
awarded  Notable Question
Jul
31
awarded  Popular Question
Jul
2
awarded  Curious
Feb
4
comment OWASP escaping recommendation - why /?
Thanks for the link to minimal rules. They make much more sense, actually.
Feb
4
comment OWASP escaping recommendation - why /?
No, it's not analogous, because / has meaning in that context, while in original context it does not, and that was the point of the question!
Feb
4
comment OWASP escaping recommendation - why /?
@FalconMomot in general, it is, but adding random characters to escape list just doesn't make sense. Why won't they then suggest to add letter Z to the list? Just to be cautious, maybe it's dangerous too. It just looks completely random, sorry.
Feb
4
comment OWASP escaping recommendation - why /?
This recommendation is specifically for content outside elements, not for attributes. For attributes they recommend completely different handling, see the next item after the one I have linked.
Feb
4
comment OWASP escaping recommendation - why /?
Well, then they should suggest escaping pretty much any non-alphanum character, since most of them have significance in some context. They don't do it. They correctly identify the characters that may be significant in HTML, but then add / which is not. Also, you can not inject <br/> since < and > are encoded, so you could inject only &lt;br/&gt; - what's wrong with that?
Feb
3
asked OWASP escaping recommendation - why /?
Jan
23
awarded  Nice Answer
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
I've asked similar question a while ago: security.stackexchange.com/questions/1335/…
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
mysql supports working over SSL.
Dec
11
awarded  Yearling
Nov
11
revised Is phpseclib a secure and reliable alternative to OpenSSL?
typo fix in title
Nov
10
suggested approved edit on Is phpseclib a secure and reliable alternative to OpenSSL?
Sep
17
comment Best way to sanitize user input in PHP
One note - htmlspecialchars() is useful only in specific HTML context - such as outside tags. E.g. if you do <img src=$var> then applying htmlspecialchars() to $var won't help you, but urlencode() might. And code may also end up inside CSS or JS where different rules apply.
Jun
18
awarded  Notable Question
Jun
13
comment Is it legal to find bugs on a website and report them to the website's owner?
BTW, I've seen instances where companies answered "we don't know what you're talking about, we're super-secure" and then quietly fixed the problem. So you may hope the good deed is still done, just you're not getting any credit for it :)