Posted by Chris Shiflett on 09/22/05 03:27

bruce wrote:
> but in all honesty, if you're going to write an app, and you're going
> to do something with the data, it makes sense to me that you
> 'know'/ensure that you're dealing with the correct kind of data. as i
> see it, this allows you another way (low entropy) to determine that
> the information you're getting is correct/valid.

Sure, but it's easy to make a mistake. Previously, you made this statement:

> the app could do something like $_GET['username'] =
> reg_check($_GET['username'])

Even if reg_check() does a perfect job of filtering the data (I'm
guessing it returns FALSE if the data is invalid), this practice
heightens the risk of making an error, becuse you can have code like this:

echo $_GET['username'];

Is that a XSS vulnerability? Any security-conscious developer should
scream at such code, so by placing filtered data back into an array that
contains only tainted data deteriorates a developer's suspicion of any
data within $_GET, $_POST, etc.

In other words, I think the sheer volume of XSS vulnerabilities out
there demonstrates that it's far too easy to mistakenly trust and use
tainted data.

Chris

--
Chris Shiflett
Brain Bulb, The PHP Consultancy
http://brainbulb.com/

[Back to original message]