|
Posted by Richard Marx on 01/21/06 00:44
"David Dorward" <dorward@gmail.com> wrote in message
news:1137759118.299567.59010@g14g2000cwa.googlegroups.com...
> Greg N. wrote:
>> <?php $planet = $_GET['planet']; ?>
>> <h1>This planet is <?php echo "$planet"; ?></h1>
>
> GET is tainted and needs to be sanitised before being dumped into the
> page. Currently you are opening up for a cross site scripting attack.
> http://uk.php.net/manual/en/function.htmlspecialchars.php should do the
> job.
Thanks, how would you recommend I change it? I.e. which characters?
Navigation:
[Reply to this message]
|