/    Sign up×
Community /Pin to ProfileBookmark

XSS protection

Copy linkTweet thisAlerts:
Aug 27.2009

Hey everyone.

This is a basic question (I think) regarding XSS protection.
I am building a web search engine (sort of like google but that searches not websites but articles in a database).

Just like google, when you search for something, the query is displayed back
at the page in two places (on the page itself and in the search textbox).

Now I had a XSS problem at the start, but I had been able to solve it by
calling the php function htmlspecialchars twice.
$sText = htmlspecialchars($s, ENT_QUOTES);
$sSearch = htmlspecialchars($s, ENT_NOQUOTES);

the $sText is the string displayed in the textbox:

<input name=”s” type=”text” style=”width:40%;” value=”<?php print $sText; ?>” />
-ENT_QUOTES replaces html code AND double quotes (so the user will not
break from the “value” attribute.

and the $sSearch is displayed right on the page:

<?php print $numHits; ?> results were found for: <?php print $sSearch; ?>.
-ENT_NOQUOTES replaces html code but leaves all the quotes intact (I want
ppl to be able to search for text with quotes, so I can’t replace it).

This is all the protection I did, and it works for anything i know of,
But a simple search in google reveals complicated unreadble functions for xss protection, and it’s not just one site.
Am I missing something? does XSS protection needs these complicated functions?

Thanks in advance,
Maor

to post a comment
PHP

6 Comments(s) ↴

Copy linkTweet thisAlerts:
@MindzaiAug 27.2009 — In short, it doesn't sound like you have anything more to do. If nothing the user enters will be executed (and it wont if you use htmlentities) then you should be fine. If there is any criteria by which you can further filter / validate your data then so much the better.
Copy linkTweet thisAlerts:
@maor121authorAug 27.2009 — Thank you for the quick reply.

What about javascript in the value of the textbox though? it isn't html.

In img objects you can add javascript into the src, isn't there a way to do the same here?

(a simple javascript: alert('x'); doesn't apear to work)
Copy linkTweet thisAlerts:
@TeufelAug 27.2009 — If you htmlentities() the whole thing the user won't be able to embed img tags.

However if you use an image embedder make sure the URL starts with a "http://"
Copy linkTweet thisAlerts:
@maor121authorAug 27.2009 — so you cannot inject javascript into the <input type="text" value="<?=$input ?>" /> ?
Copy linkTweet thisAlerts:
@MindzaiAug 27.2009 — Thank you for the quick reply.

What about javascript in the value of the textbox though? it isn't html.[/QUOTE]

The javascript itself isn't, but for inline javascript to be executed it needs to be inside HTML <script> tags, which will be rendered useless with html_entities. The same goes with event handler attributes (onclick etc) - the tag that these attributes belong to will not be treated as a tag at all by the browser, therefore the js will not be executed. Where you will need something more complex is if you want to allow certain tags, in which case you will probably need to come up with a function using strip_tags, preg_replace etc to get what you need. However if you are happy just to run the whole thing through htmlentities then you should be covered.
Copy linkTweet thisAlerts:
@maor121authorAug 27.2009 — Thats it then.

But building a custom filter... that could be really complicated and long (just like those functions from google ? )

Thank you for all of your help,

Maor
×

Success!

Help @maor121 spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 — BETA 6.2,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,
)...