918 reputation
616
bio website php100.wordpress.com
location San Jose, CA
age 40
visits member for 3 years, 11 months
seen Aug 28 at 20:49
Programmer (Unix, Windows, C, C++, PHP, etc.)

Sep
3
awarded  Good Question
Aug
28
awarded  Notable Question
Jul
31
awarded  Popular Question
Jul
2
awarded  Curious
Feb
4
comment OWASP escaping recommendation - why /?
Thanks for the link to minimal rules. They make much more sense, actually.
Feb
4
comment OWASP escaping recommendation - why /?
No, it's not analogous, because / has meaning in that context, while in original context it does not, and that was the point of the question!
Feb
4
comment OWASP escaping recommendation - why /?
@FalconMomot in general, it is, but adding random characters to escape list just doesn't make sense. Why won't they then suggest to add letter Z to the list? Just to be cautious, maybe it's dangerous too. It just looks completely random, sorry.
Feb
4
comment OWASP escaping recommendation - why /?
This recommendation is specifically for content outside elements, not for attributes. For attributes they recommend completely different handling, see the next item after the one I have linked.
Feb
4
comment OWASP escaping recommendation - why /?
Well, then they should suggest escaping pretty much any non-alphanum character, since most of them have significance in some context. They don't do it. They correctly identify the characters that may be significant in HTML, but then add / which is not. Also, you can not inject <br/> since < and > are encoded, so you could inject only &lt;br/&gt; - what's wrong with that?
Feb
3
asked OWASP escaping recommendation - why /?
Jan
23
awarded  Nice Answer
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
I've asked similar question a while ago: security.stackexchange.com/questions/1335/…
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
mysql supports working over SSL.
Dec
11
awarded  Yearling
Nov
11
revised Is phpseclib a secure and reliable alternative to OpenSSL?
typo fix in title
Nov
10
suggested suggested edit on Is phpseclib a secure and reliable alternative to OpenSSL?
Sep
17
comment Best way to sanitize user input in PHP
One note - htmlspecialchars() is useful only in specific HTML context - such as outside tags. E.g. if you do <img src=$var> then applying htmlspecialchars() to $var won't help you, but urlencode() might. And code may also end up inside CSS or JS where different rules apply.
Jun
18
awarded  Notable Question
Jun
13
comment Is it legal to find bugs on a website and report them to the website's owner?
BTW, I've seen instances where companies answered "we don't know what you're talking about, we're super-secure" and then quietly fixed the problem. So you may hope the good deed is still done, just you're not getting any credit for it :)
Jun
10
comment What are the implications of NSA surveillance on the average internet user?
There's actually more than two stories. E.g. story about IRS considering every mailbox public information not requiring a warrant: aclu.org/blog/technology-and-liberty-national-security/…