|
|
Posted by Sebastian Lisken on 01/15/08 02:24
Hi, I'm in the process of securing a PHP/MySQL website by making sure
all strings that can at least possibly be manipulated from the outside
are passed through the appropriate escaping functions and/or validated
against patterns. In the most canonical cases, SQL strings supplied from
the outside are handled by mysql_real_escape_string, HTML snippets by
htmlentities, GET parameters in query strings by rawencodeurl. What I'm
unsure about is whether SID needs to be treated. It's the variable used
most often, so I guess I could improve efficiency a bit by not adding
an escaping functions in snippets such as
<a href="<? echo htmlentities($_SERVER['PHP_SELF']) . "?" . SID; ?>">
Is there a known scenario in which an attacker could set SID to contain,
say, HTML that could then be used in an XSS attack?
Thanks for your opinions
Sebastian Lisken
Navigation:
[Reply to this message]
|