|
|
Posted by Lisa Pearlson on 11/11/05 20:58
> If you haven't checked that $subject contains no HTML tags, then the
> hacker
> can insert whatever he likes into your HTML, such as a link to some other
> website, or piece of Javascript that redirects the page automatically.
> That
> would be a serious problem if the page was part of an online banking site
> (Google for "phishing" if you can't figure out why).
Yes, so after "isUnsafe" I actually call htmlspecialchars()
Navigation:
[Reply to this message]
|