Comments on: Cross Site Scripting: what it is, and how to prevent it

By: me

me — Thu, 07 Jan 2010 03:07:59 +0000

I'd say that if someone has accessed your database and hand entered the data you have bigger problems than XSS attacks. Escaping before inputting into the database means you only need to escape once which makes things more efficient. Also use htmlspecialchars not htmlentities it does the same job but uses less resources.

By: ABDUKRAHMAN

ABDUKRAHMAN — Wed, 14 Oct 2009 08:01:33 +0000

Woo this is a nice blog, i would love to read more.

Thanks
oemal
______________________________________________
xbox repair services | best auto insurance rates | san miguel de allende real estate

By: Luke

Luke — Mon, 29 Dec 2008 17:56:31 +0000

Roy,
You could definitely do both – how much you allow or disallow is entirely up
to you.

By: Roy

Roy — Sun, 28 Dec 2008 14:46:45 +0000

So why not simply do both? Make Account names viable if they are only Numbers and letters( ex A-Z, a-z, 0-9), no other char allowed, as well as escaping the repeating information?

By: Luke

Luke — Fri, 07 Nov 2008 00:36:43 +0000

While it would make sense to escape the username before it enters the
database, escaping it afterwards helps protect you against XSS attacks that
originate *from* your database – for example, if an attacker gained access
to your database and hand-entered the data.
Rejecting usernames that have special characters in them isn't a bad idea,
but it tends to confuse the user – which characters are invalid? Which
aren't? It would be more useful if you could tell them which characters were
not allowed.

By: Abraxas

Abraxas — Thu, 06 Nov 2008 04:39:04 +0000

I agree that as a general rule this is excellent practice but for something like the user name wouldn't it make for sense to escape it before adding it to the database instead of every time it is displayed? In fact as part of my registration validation I compare the user name with the return from the escape function and if they're not equal I reject the name:

if ($username != htmlspecialchars($username)) {
$err = “name contains invalid characters”;
}