Not signed in (Sign In)

Categories

Vanilla 1.1.2 is a product of Lussumo. More Information: Documentation, Community Support.

JOT
Welcome Guest!
Want to take part in these discussions? If you have an account, sign in now.
If you don't have an account, apply for one now.
  1.  
    someone added this to our init-config loader at work. im still not sure what xss is, but my eyes tell me it has something to do with javascript inside a request. anyways, steal this if you want

    if (!checkUserInput($_SERVER['REQUEST_URI']) || !checkUserInput($_REQUEST)) {
    // log the event
    // kill script
    }

    function checkUserInput($check)
    {
    $scripting = '/(%3C|<|&lt;|&#60;)\s*(script|\?)/iU';
    $ascii_chars = '/%(0|1)(\d|[a-f])/i';

    if (is_array($check)) {
    foreach ($check as $check_val) {
    if (!checkUserInput($check_val)) {
    return FALSE;
    }
    }
    return TRUE;
    } else {

    if (preg_match($scripting, $check) ||
    preg_match($ascii_chars, $check)) {
    return FALSE;
    }
    return TRUE;
    }
    }
    • CommentAuthor_Lemon_
    • CommentTimeSep 10th 2007
     

    So a function that removes <script> tags from your user input? What about the onclick, onsubmit etc of elements? If you take this approach, you’ll most likely find so many problems. Then, what happens in a forum like this? I want to display my code for others to see, not attack the site.

    In general I find it’s better to explicitly replace all string inputs as I put them into the database. Using the following function (it sits inside the parse class)

    static public function encode($string) { return(str_replace(array(’&’, ‘<’, ‘>’, ‘\’‘, ‘”’), array(’&#38;’, ‘&#60;’, ‘&#62;’, ‘&#39;’, ‘&#34;’), $string)); }

    Then, on longer strings, expected to be multi-line, as they are displayed I’ll run them through a forum tag style function which pretty much puts in <br />, <b> and so on. 99% of input string comes from the database or a similar source. Those exceptions are generally when a script redirects and wants to display a ‘You must be logged in.’ message, for example. These are pretty static so a simple isset($_GET[‘out’]) is done to display the error (avoiding passing strings across scripts through input like this).

    I’ve also noticed the use of $_REQUEST, isn’t this bad programming practice in PHP? You’re not being entirely clear on where your input is coming from and in particular, appending ?text=asdf to the url bar is a helluva lot easier than adding it to the POST string (I’m sure there are other, better, reasons that my brain just can’t even comprehend at 11am in the morning…).

    • CommentAuthorNSA
    • CommentTimeSep 10th 2007
     
    Easier than your replace function, just do a htmlspecialchars() or htmlentities(); If you want to be totally destructive, you can also do a strip_tags();
  2.  
    :face-devil-grin: exactly!
    • CommentAuthorvowino
    • CommentTimeAug 1st 2008
     
    may i get good oop-php notes?i'm beginning in oop-php programing
    • CommentAuthorkimekime
    • CommentTimeAug 4th 2009
     

    If you take a moment in the wedding invitations and bustle of preparing for that special day, there is no reason not to take the time to make sure wedding invitation are not harming the economy to be able to announce that special day. The fact is, most of the people that get your unique wedding invitations, sometime after that special day, will end up in the trash.

    • CommentAuthorkimekime
    • CommentTimeDec 8th 2009
     

    [url=http://www.vponsale.com]wedding dresses[/url]
    [url=http://www.vponsale.com/invitations/]wedding invitations[/url]
    [url=http://www.vponsale.com/bridesmaid-dresses/]bridesmaid dresses[/url]
    [url=http://www.rs2guru.com]wedding invitations[/url]
    [url=http://www.vponsale.com/wedding-dresses/]wedding dresses[/url]
    [url=http://www.vponsale.com/invitation/]wedding invitations[/url]
    [url=http://www.vponsale.com/bridesmaid/]bridesmaid dresses[/url]
    [url=http://www.rpgshow.com/lace-front-wigs-c-12.html]lace front wigs[/url]
    [url=http://www.rpgshow.com/lace-wigs-c-9.html]lace wigs[/url]
    [url=http://www.vponsale.com/index.php?main_page=index&cPath=128]wedding gowns[/url]

    • CommentAuthorwedding
    • CommentTimeJul 27th 2010
     

    What a professional Wedding Planner actually does is take on the details and responsibility of the event, [url=http://www.dressespro.com/]cheap prom dresses[/url]relieving the bride and groom and their families, from the stresses involved. In turn,[url=http://www.vpbridal.com/prom-dresses/]prom dresses[/url] this allows them to enjoy the preliminary wedding events, like bridal showers and picking a honeymoon location.There are lots of details you, as a Wedding Planner,[url=http://www.owigs.com/hair-extensions/]hair extensions[/url] need to know to keep things running smoothly and within the budget available. You will have to have a set of resources you can tap into to get the best service at the best prices, [url=http://www.owigs.com/]lace wigs[/url]like reserving the church or chapel, catering the reception, ordering flowers, getting the wedding dress designed and ordered, selecting invitations and announcements,[url=http://www.vponsale.com/invitations/]wedding invites[/url] booking the music and hiring a professional photographer, among many other tasks.Nily Glaser pays special attention to enlighten educators,[url=http://www.vponsale.co.uk/]wedding invitations[/url] families and wedding professionals. Her web site is a very popular Wedding Resource and Information Center, and a discount shopping mall for wedding gifts, supplies, bridal accessories, [url=http://www.vponsale.com/bridesmaid-dresses/]discount bridesmaid dresses[/url]favors and print your own invitations, including the exclusive line of Wedding Accessories By Nily.A-wedding day specializes in theme and blending family weddings and in do it yourself projects.The wedding day is only part of the term wedding as a whole.[url=http://www.owigs.com/hair-extensions/clip-in-hair-extensions-c-1.html]clip in hair extensions[/url] Wedding as it will be referred to in this article includes the preparations for, and the activities following the big day including the honeymoon. So, you got engaged and are looking forward with anticipation, to your dream wedding but do not know where to start and what to do.[url=http://www.owigs.com/]wigs[/url] You are not alone! This article is dedicated to the many engaged couples facing this dilemma and those who want to be focused.

    • CommentAuthorwedding
    • CommentTimeJul 27th 2010
     
    cheap prom dresses prom dresses hair extensions lace wigs wedding invites wedding invitation discount bridesmaid dresses clip in hair extensions wigs
    • CommentAuthorwedding
    • CommentTimeJul 27th 2010
     
    [url=http://www.dressespro.com/]cheap prom dresses[/url]
    [url=http://www.vpbridal.com/prom-dresses/]prom dresses[/url]
    [url=http://www.owigs.com/hair-extensions/]hair extensions[/url]
    [url=http://www.owigs.com/]lace wigs[/url]
    [url=http://www.vponsale.com/invitations/]wedding invites[/url]
    [url=http://www.vponsale.co.uk/]wedding invitations[/url]
    [url=http://www.vponsale.com/bridesmaid-dresses/]discount bridesmaid dresses[/url]
    [url=http://www.owigs.com/hair-extensions/clip-in-hair-extensions-c-1.html]clip in hair extensions[/url]
    [url=http://www.owigs.com/]wigs[/url]
    • CommentAuthorwedding
    • CommentTimeJul 27th 2010
     
    <a href="http://www.dressespro.com/">cheap prom dresses</a>
    <a href="http://www.vpbridal.com/prom-dresses/">prom dresses</a>
    <a href="http://www.owigs.com/hair-extensions/">hair extensions</a>
    <a href="http://www.owigs.com/">lace wigs</a>
    <a href="http://www.vponsale.com/invitations/">wedding invites</a>
    <a href="http://www.vponsale.co.uk/">wedding invitation</a>
    <a href="http://www.vponsale.com/bridesmaid-dresses/">discount bridesmaid dresses</a>
    <a href="http://www.owigs.com/hair-extensions/clip-in-hair-extensions-c-1.html">clip in hair extensions</a>
    <a href="http://www.owigs.com/">wigs</a>