Pastebin allow you to (along with plenty of other sites) input code into there forms.

I know that this can be a huge security threat if not done properly so I would like to know how they go about this? 'this' Being to allow the input of all data into a form without any security issues.

Edit- Is anyone able to show a simple example?


The two main risks of a system such as this are:

The risk of SQL Injection is mitigated by the use of parameterised queries. This ensures that data values inserted into the database can only be interpreted as data and not by part of the query by an attacker escaping out of the context.

XSS is prevented by correct output escaping. This prevents the browser from interpreting any markup or code as script and it will render the visual representation of the markup instead. This should be done by your application on output of data to the browser, and usually shouldn't be stored in this format. This is because if you later have to output the data in any other format (e.g. JSON or plain text) things can get complicated because you'll first have to convert back to plain text before re-encoding and this is where mistakes can easily happen to leave your application vulnerable.


You escape the output by replacing "special" characters with their HTML character entities. In PHP, you can do this using htmlspecialchars(), for example. I suggest using the ENT_QUOTES flag to ensure all types of quotes get encoded.

  1. Set <form> accept-charset Attribute using UTF-8
  2. Sanitize all the html / xml special characters and replace them with their escaped version.
  3. Display the code within the <pre> tags

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.