Revisions to False Positives- Server side protection against XSS

replaced http://nl3.php.net with https://www.php.net

Source Link

edited Nov 17, 2023 at 20:08

1

First, what htmlspecialchars()htmlspecialchars() and similar functions do isn't removing dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

First, what htmlspecialchars() and similar functions do isn't removing dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

First, what htmlspecialchars() and similar functions do isn't removing dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

edited body

Source Link

edited Mar 4, 2014 at 10:29

user2428118

2.8k
18
23

First, what htmlspecialchars() and similar functions do isn't escapingremoving dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

First, what htmlspecialchars() and similar functions do isn't escaping dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

First, what htmlspecialchars() and similar functions do isn't removing dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

added 13 characters in body

Source Link

edited Mar 4, 2014 at 10:21

user2428118

2.8k
18
23

First, what htmlspecialchars() and similar functions do isn't escaping dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the samethe same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

First, what htmlspecialchars() and similar functions do isn't escaping dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes
Server escapes the data as HTML
Server outputs the data to the client

First, what htmlspecialchars() and similar functions do isn't escaping dangerous code, it's encoding data as HTML.

So, what htmlspecialchars does not do is the following:

Receive data
Find dangerous HTML code and replace this by harmless code
Return the sanitized data

But it does the following:

Receive data
Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
Return the HTML code

➥ You can see the difference here

Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.

So, you should not be doing it like this:

Server receives data from a client
Server escapes the data as HTML
Server processes the data
Server outputs the data to the client

But like this:

Server receives data from a client
Server processes the data
Server escapes the data as HTML
Server outputs the data to the client

added 421 characters in body

Source Link

edited Mar 4, 2014 at 10:13

user2428118

2.8k
18
23

Loading

Source Link

created Mar 4, 2014 at 9:14

user2428118

2.8k
18
23

Loading

Stack Exchange Network

Return to Answer