Keith Devens .com

Look. It's really easy:

Escape everything that comes in. Escape everything that goes out.

If you're sticking something into an SQL string and not escaping it, then that's bad -- unless of course you've already confirmed that it's (for instance) numeric, or you're being a fancy pants and using prepared statements.

If you're outputting something (into an HTML stream) and not escaping it, then that's bad. I see so many people using tags in Smarty and outputting variables like {$var}. AFAIK, Smarty doesn't do any automatic escaping, so you're really opening yourself up to XSS attacks, or at least allowing your HTML to be broken. I do almost all my (HTML) output in PHP with the following function:


<?php function e($str){ echo htmlspecialchars($str); }?>

It's even easier than typing echo, except I need parens.

Footnotes:
[1]: I've seen references to the article floating around the web elsewhere, but I don't remember where. Ah, here's one, but I don't remember the other.

Permalink | 4 Comments | Tags: Programming | id 6368

16:57 (utc-5)
edited: 17:43 (utc-5)

Comments

As an alternative to escaping, use a "real DB" whose API has support for commands and parameters. I think MySQL DB is sprouting this feature soonish.

∴ Adam V. | 7-Jan-2005 5:43pm est | http://flangy.com | #6802

Yeah, that's the type of thing I was referring to when I was talking about prepared statements.

∴ Keith | 7-Jan-2005 5:44pm est | http://keithdevens.com/ | #6803

Smarty doesn't do automatic escaping, but you can force it with modifiers:


{$var|escape}

translates to


<?php echo htmlspecialchars($var); ?>

Yeah, I know. But I never see anyone using them where they should be.

∴ Keith | 7-Jan-2005 6:41pm est | http://keithdevens.com/ | #6807

Feel free to post a comment below. Please see my comment policy.

Formatting Rules (No HTML):

**bold**, *italic*, _underlined_, --strikeout--
"text"="url" creates a link, and URLs are auto-highlighted
Blockquote: Like e-mail, begin paragraph with > (greater-than sign)
Lists: begin paragraph with *,-, or + (unordered), or # (ordered)
Code block: ?!code:language=perl|php|sql|javascript|etc.{\n}...{\n}?!/code

October 2008

Sun

Mon

Tue

Wed

Thu

Fri

Sat

Friday, January 7, 2005

Web site security holes

Comments

Recent comments