0

I just wrote this function to parse strings and prevent XSS:

  function tep_sanitize_string($string) {
    $patterns = array ('/ +/','/[<>]/');
    $replace = array (' ', '_');
    return preg_replace($patterns, $replace, trim($string));
  }

Is there any way to bypass this filter? P.S.: In my application the $string will never takes place into src="" parameters or similar.

  • use%20of%20url%20encoded%20strings%3A%2F%3F%5B%3C%3E%5D – CaffeineAddiction Jan 12 '17 at 15:11
  • No way, input is sanitized successfully. – user136149 Jan 12 '17 at 15:19
5

If your security is based on "in my application common use case X will never happen", it will likely fail.

First of, input sanitation is not the correct approach to XSS, context dependent encoding is.

Your approach is also overly complex. Why do you filter space and +? Why replace < and > with _, but the others with space?

Your approach is also not very user-friendly. < and > are used legitimately all the time, as is +.

All that being said, no, in a plain HTML context - not in a HTML attribute context, CSS or JS context, etc - XSS cannot take place without < and >, so there would be no way to bypass the filter. In other contexts, XSS can still happen. Even if you don't currently put user input in other contexts, you or another developer will do so in the future. And they will just assume that a function called tep_sanitize_string will be secure here as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.