Linked Questions
10 questions linked to/from Filter user input before the database or upon display?
23
votes
5
answers
28k
views
Input Sanitization vs Output Sanitization [duplicate]
In the bits that I've searched about this, I've seen a few people declare as word-of-god that you should only sanitize outputs and not inputs. Why? Would it not be safer to cover both ends?
- 359
5
votes
2
answers
846
views
Should every output element be filtered, or just those which contain user-editable data? [duplicate]
I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
- 221
0
votes
1
answer
1k
views
Why is it a bad idea to escape HTML before escaping SQL? [duplicate]
From the security perspective (and not usability as it's discussed here https://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), ...
user15194
6
votes
5
answers
19k
views
Blacklisting vs. whitelisting characters to prevent XSS?
I've been reading about XSS prevention on OWASP and other security channels. They all say that I should use ESAPI or a similar library and do input filtering through a whitelist approach.
However, I ...
- 2,098
12
votes
4
answers
15k
views
PHP functions for preventing XSS
Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
- 601
8
votes
3
answers
5k
views
PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?
For days now I try to get my head round how to write a secure web application in php, and it turns out to be particularly difficult. The more I read, the more I sink in deep swamps full of ...
user9651
7
votes
3
answers
854
views
Could this solve SQL injection and XSS vulnerabilities?
edit I got some good responses about Frameworks but the crucial part of this is that it's built into the programming language itself, so it's literally impossible to write an XSS vulnerable or SQL ...
- 337
14
votes
2
answers
2k
views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
- 862
5
votes
4
answers
2k
views
Is JavaScript self-injection dangerous?
I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a ...
- 183
3
votes
2
answers
2k
views
Is Drupal's filter_xss enough for filtering HTML?
Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input?
If not, what should be used instead when using Drupal 7?
This questuion is a duplicate of Drupal's built-in ...
- 5,337