966 reputation
817
bio website php100.wordpress.com
location San Jose, CA
age 40
visits member for 4 years, 7 months
seen 20 hours ago
Programmer (Unix, Windows, C, C++, PHP, etc.)

Jul
25
awarded  Constituent
Jul
21
awarded  Caucus
Dec
11
awarded  Yearling
Sep
3
awarded  Good Question
Aug
28
awarded  Notable Question
Jul
31
awarded  Popular Question
Jul
2
awarded  Curious
Feb
4
comment OWASP escaping recommendation - why /?
Thanks for the link to minimal rules. They make much more sense, actually.
Feb
4
comment OWASP escaping recommendation - why /?
No, it's not analogous, because / has meaning in that context, while in original context it does not, and that was the point of the question!
Feb
4
comment OWASP escaping recommendation - why /?
@FalconMomot in general, it is, but adding random characters to escape list just doesn't make sense. Why won't they then suggest to add letter Z to the list? Just to be cautious, maybe it's dangerous too. It just looks completely random, sorry.
Feb
4
comment OWASP escaping recommendation - why /?
This recommendation is specifically for content outside elements, not for attributes. For attributes they recommend completely different handling, see the next item after the one I have linked.
Feb
4
comment OWASP escaping recommendation - why /?
Well, then they should suggest escaping pretty much any non-alphanum character, since most of them have significance in some context. They don't do it. They correctly identify the characters that may be significant in HTML, but then add / which is not. Also, you can not inject <br/> since < and > are encoded, so you could inject only &lt;br/&gt; - what's wrong with that?
Feb
3
asked OWASP escaping recommendation - why /?
Jan
23
awarded  Nice Answer
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
I've asked similar question a while ago: security.stackexchange.com/questions/1335/…
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
mysql supports working over SSL.
Dec
11
awarded  Yearling
Nov
11
revised Is phpseclib a secure and reliable alternative to OpenSSL?
typo fix in title
Nov
10
suggested approved edit on Is phpseclib a secure and reliable alternative to OpenSSL?
Sep
17
comment Which is the best way to sanitize user input in PHP?
One note - htmlspecialchars() is useful only in specific HTML context - such as outside tags. E.g. if you do <img src=$var> then applying htmlspecialchars() to $var won't help you, but urlencode() might. And code may also end up inside CSS or JS where different rules apply.