Posted by Chris Shiflett on 09/22/05 02:02

Jasper Bryant-Greene wrote:
> Before outputting anything user-sourced to the browser,
> htmlspecialchars() it, preferably with the ENT_QUOTES option. If you
> want to allow some HTML, only then parse the string to un-escape
> certain HTML tags.

Jasper++

> Check the types if it's a problem for you (using PHP's many type
> functions);

Checking data types can be very misleading. I've seen many examples
(even recently in a book) that use is_int() to check to see whether
something in $_GET or $_POST is an integer. Because everything in $_GET
and $_POST is a string, this check always fails.

Chris

--
Chris Shiflett
Brain Bulb, The PHP Consultancy
http://brainbulb.com/

• Next in forum: Re: [PHP] security/sql issues with php
• Prev in forum: Re: [PHP] losing session data with cross-site scripting
• Thread view: Re: [PHP] security/sql issues with php

[Reply to this message]