Linked Questions

23 votes
5 answers

Input Sanitization vs Output Sanitization [duplicate]

In the bits that I've searched about this, I've seen a few people declare as word-of-god that you should only sanitize outputs and not inputs. Why? Would it not be safer to cover both ends?
Todd Schwine's user avatar
5 votes
2 answers

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
a coder's user avatar
  • 221
0 votes
1 answer

Why is it a bad idea to escape HTML before escaping SQL? [duplicate]

From the security perspective (and not usability as it's discussed here, ...
user avatar
6 votes
5 answers

Blacklisting vs. whitelisting characters to prevent XSS?

I've been reading about XSS prevention on OWASP and other security channels. They all say that I should use ESAPI or a similar library and do input filtering through a whitelist approach. However, I ...
Novice User's user avatar
  • 2,098
12 votes
4 answers

PHP functions for preventing XSS

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
Casebash's user avatar
  • 601
8 votes
3 answers

PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?

For days now I try to get my head round how to write a secure web application in php, and it turns out to be particularly difficult. The more I read, the more I sink in deep swamps full of ...
user avatar
7 votes
3 answers

Could this solve SQL injection and XSS vulnerabilities?

edit I got some good responses about Frameworks but the crucial part of this is that it's built into the programming language itself, so it's literally impossible to write an XSS vulnerable or SQL ...
jdoe's user avatar
  • 337
14 votes
2 answers

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
Indolering's user avatar
5 votes
4 answers

Is JavaScript self-injection dangerous?

I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a ...
cberzan's user avatar
  • 183
3 votes
2 answers

Is Drupal's filter_xss enough for filtering HTML?

Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input? If not, what should be used instead when using Drupal 7? This questuion is a duplicate of Drupal's built-in ...
Andrei Botalov's user avatar