My app creates an PDF file and uses an user entered info. How can I avoid all attacks with PDF vector?

Will htmlspecialchars be enough?

I don't want to enable JavaScript in PDF.

  • Hi. You'll need to provide more info as to what you are wanting to protect and how sensitive it is. You will never be able to avoid all attacks through a particular vector unless you remove the vector, so instead you need to look at appropriate controls and to answer this we need to know what your risk acceptance level is.
    – Rory Alsop
    Jan 20, 2012 at 8:46
  • users will enter text data via web forms, then i will use this data for generating tables in PDF.
    – RusAlex
    Jan 20, 2012 at 18:39

1 Answer 1


How are you generating your PDFs? Unless you are creating HTML markup and using a tool to convert that to PDF, htmlspecialchars won't be of any use to you. < and & are not special in PDF text content.

If you are using the PHP PDFlib functions like PDF_add_table_cell to put your text in the document, there is no need for any particular kind of escaping. Those functions take raw text without any characters being 'special'. Other than general-purpose input filtering to remove unwanted control characters, no string preparation steps should be necessary.

I'm not sure what attacks you're trying to avoid; the most common problem with PDF is embedded scripting malware, but unless you're deliberately putting script in (using eg PDF_create_action) there won't be any in your produced document.

There was a global-XSS vulnerability in the browser PDF plugin once that affected any site hosting a PDF; if you want to ensure protection from that for users with old plugins you can serve all your PDFs with Content-Disposition: attachment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .