Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31208

Re: Javascript injection

Path csiph.com!2.eu.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!news.albasani.net!.POSTED!not-for-mail
From Hans-Georg Michna <hans-georgNoEmailPlease@michna.com>
Newsgroups comp.lang.javascript
Subject Re: Javascript injection
Date Mon, 29 Aug 2016 15:58:03 +0200
Organization albasani.net
Lines 11
Message-ID <fof8sbd9g2sg3ll5lf232fkd4oapjdvrth@4ax.com> (permalink)
References <2a5cf91a-151b-4379-9510-5dcd5a5bb196@googlegroups.com>
Mime-Version 1.0
Content-Type text/plain; charset=us-ascii
Content-Transfer-Encoding 7bit
X-Trace news.albasani.net 0rI4GVmCqI1QCKdNvyIGcRVrNpEQVZDoyTi4Flp02CcMjFXHVjipZhpLOwgX5cQos5W6uaTXnGfn65khGBozj/n3eAtyhXiDTrwX4lnsWt97VM1o/L8ZNU/y65dMCF0O
NNTP-Posting-Date Mon, 29 Aug 2016 13:58:03 +0000 (UTC)
Injection-Info news.albasani.net; logging-data="dPBPqtzeHc5wiKzBjllrDZ84PNHqivrpg5bJu8BKuPNVMgsltBz0DXM4Vmmd4lqHIhS0RoJOOzU7+Pa0T8n+c44z7hkMPjRlJG4eUQKtS2jbF6AX+ACn4i8uP4l9I4Vl"; mail-complaints-to="abuse@albasani.net"
User-Agent ForteAgent/7.10.32.1212
Cancel-Lock sha1:RQTVq6aurX6ORJ+0VkWZL+neg8U=
Xref csiph.com comp.lang.javascript:31208

Show key headers only | View raw

On Sun, 28 Aug 2016 22:58:08 -0700 (PDT),
bit-naughty@hotmail.com wrote:

>If I have a "forum" type of site, where stuff is being posted, and stored in the backend (in a MySQL database, using PHP), say,....can anyone type in Javascript into the post to accomplish naughty things? What's the most nefarious thing anyone can do? All I can think of is that someone would deface the page somehow, that *that* post is on, which, really, I can't see the point of..... Anything else?
>...and how do I protect against it? (the post will probably be displayed inside a DIV on the page, I think....)

I would not even allow ordinary users to enter HTML tags, i.e.
have them filtered out. This, of course, includes <script ...>
tags, so users cannot inject any script.

Hans-Georg

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Javascript injection bit-naughty@hotmail.com - 2016-08-28 22:58 -0700
  Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-29 11:27 +0200
  Re: Javascript injection Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> - 2016-08-29 15:58 +0200
    Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-29 17:10 +0200
      Re: Javascript injection Aleksandro <aleksandro@gmx.com> - 2016-08-30 16:35 -0300
        Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-31 10:25 +0200
          Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-31 12:43 +0200

csiph-web