10 replies to this topic

[VakhoQ]

I want to safe my web page from XSS attacks. So i'm going to filter my web page.

I made this:
if i find "<", i will change it to <.
if i find ">", i will change it to >.

<?php

function something($string){

$search = array('<', '>');

$replace = array('<', '>'); 

return str_replace($search, $replace, $string); 

}

$string = '<script> code here </script>';

echo something($string);

?>

Everithing is all right. now, for example, hacker is tring to Hack my web page. he will
convert "<script> code </script>" to hex or base64 or Decimal. Will my script work in this situation? its interesting for me...


Character Encoding Calculators Web pages:
XSS (Cross Site Scripting) Cheat Sheet (on the bottom of the page)
Surrogate Pair Calculator etc.

[strider96]

What you are basically doing is making it harder for a human to read.

It's very easy to convert your script back to the original format.

If you really want protection I suggest you use:
Ioncube or SourceGuardian (Google is your Friend.)

[VakhoQ]

I hope there are people , on the porum, who can help me =))

[Orjan]

there are even better way, look up PHP: htmlentities - Manual ! it converts all you need for this purpose...

[Orjan]

strider96 said:

What you are basically doing is making it harder for a human to read.

It's very easy to convert your script back to the original format.

If you really want protection I suggest you use:
Ioncube or SourceGuardian (Google is your Friend.)

You don't seem to understand it's purpose?

[VakhoQ]

thank you for advices. :)
is htmlentities() enough? for example for:
base64? (Ij48c2NyaXB0PmFsZXJ0KC9oYWNraW5nIGF0dGVtcHQvKTwvc2NyaXB0PiA=)
hex? ...

[Orjan]

Yes, it removes output of valid HTML inside the string and makes it printed instead of parsed when stored or re-echoed to the page

[VakhoQ]

thanks a lot ;)

[Alexander]

htmlentities converts things such as ' to ' which is not all required for security, you can get away with the htmlspecialchars command if that is relevant to you.

The links you linked to relate to something else, such as allowing user HTML and filtering out bad HTML, the XSS cheatsheet can provide vectors to bypass HTML filtering, but you are not allowing HTML at all, so it is not needed.

[Orjan]

Oh, my bad, I forgot about the htmlspecialchars(), of course is that one enough.

[VakhoQ]

Alexander

I'm now PHP programmist. I did not know this. thanks a lot ;)