Re: Javascript injection

Path	csiph.com!1.us.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!news.roellig-ltd.de!open-news-network.org!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From	"Christoph M. Becker" <cmbecker69@arcor.de>
Newsgroups	comp.lang.javascript
Subject	Re: Javascript injection
Followup-To	comp.lang.php
Date	Wed, 31 Aug 2016 12:43:42 +0200
Organization	solani.org
Lines	43
Message-ID	<nq6cch$l2v$1@solani.org> (permalink)
References	<2a5cf91a-151b-4379-9510-5dcd5a5bb196@googlegroups.com> <fof8sbd9g2sg3ll5lf232fkd4oapjdvrth@4ax.com> <XnsA673AEAA339D3eejj99@194.109.6.166> <nq4n62$hjg$1@dont-email.me> <XnsA67569FA9267Feejj99@194.109.6.166>
Mime-Version	1.0
Content-Type	text/plain; charset=utf-8
Content-Transfer-Encoding	8bit
X-Trace	solani.org 1472640209 21599 eJwNy8EBgDAIA8CVipDQdQDJ/iPo/Q9O42QQDAhyHbedDSqW7zWkDkqPUx1xu7e0Vcj619gHKFQR7A== (31 Aug 2016 10:43:29 GMT)
X-Complaints-To	abuse@news.solani.org
NNTP-Posting-Date	Wed, 31 Aug 2016 10:43:29 +0000 (UTC)
User-Agent	Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
In-Reply-To	<XnsA67569FA9267Feejj99@194.109.6.166>
Cancel-Lock	sha1:+WtIBamXft2/xTnqk86hY7EsStM=
X-User-ID	eJwFwYERAEEEBLCWOHZRjuH1X8InMConnKDjcHwh5fWRNZO2qUZvmdZYBlatt+2JqBcS9wMB+RAV
X-NNTP-Posting-Host	eJwNyskBwDAIA7CVymW8DiSw/wip3gqD4KQj4LGxbFcUdCSsBlLD3Luwzk/o5so7PVbg+W8+GGcRCA==
Xref	csiph.com comp.lang.javascript:31220

Followups directed to: comp.lang.php

Show key headers only | View raw

On 31.08.2016 at 10:25, Evertjan. wrote:

> Aleksandro <aleksandro@gmx.com> wrote on 30 Aug 2016 in 
> comp.lang.javascript:
> 
>> On 29/08/16 12:10, Evertjan. wrote:
>>> Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> wrote on 29 Aug
>>> 2016 in comp.lang.javascript: 
>>>
>>>> On Sun, 28 Aug 2016 22:58:08 -0700 (PDT),
>>>> bit-naughty@hotmail.com wrote:
>>>>
>>>>> If I have a "forum" type of site, where stuff is being posted, and
>>>>> stored in the backend (in a MySQL database, using PHP), say,....can
>>>>> anyone type in Javascript into the post to accomplish naughty things?
>>>>> What's the most nefarious thing anyone can do? All I can think of is
>>>>> that someone would deface the page somehow, that *that* post is on,
>>>>> which, really, I can't see the point of..... Anything else? ...and how
>>>>> do I protect against it? (the post will probably be displayed inside a
>>>>> DIV on the page, I think....) 
>>>>
>>>> I would not even allow ordinary users to enter HTML tags, i.e.
>>>> have them filtered out. This, of course, includes <script ...>
>>>> tags, so users cannot inject any script.
>>>
>>> theText = theText.replace(/</g,'&lt;');
>>
>> Serversidely OT: http://php.net/str_replace
> 
> You better [for this NG] use ASP + Jscript, making my suggestion ON topic.

ACK.  However, the OP mentions:

| If I have a "forum" type of site, where stuff is being posted, and
| stored in the backend (in a MySQL database, using PHP) […]

Therefore this newsgroup is somewhat OT anyway.  Therefore, FUP2 c.l.php.

BTW: don't use str_replace() in this case; use htmlspecialchars() with
the appropriate $encoding.  Consider to also use strip_tags().

-- 
Christoph M. Becker

Back to comp.lang.javascript | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Javascript injection bit-naughty@hotmail.com - 2016-08-28 22:58 -0700
  Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-29 11:27 +0200
  Re: Javascript injection Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> - 2016-08-29 15:58 +0200
    Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-29 17:10 +0200
      Re: Javascript injection Aleksandro <aleksandro@gmx.com> - 2016-08-30 16:35 -0300
        Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-31 10:25 +0200
          Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-31 12:43 +0200

csiph-web