Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31202 > unrolled thread

Javascript injection

Back to article view | Back to comp.lang.javascript

Contents

  Javascript injection bit-naughty@hotmail.com - 2016-08-28 22:58 -0700
    Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-29 11:27 +0200
    Re: Javascript injection Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> - 2016-08-29 15:58 +0200
      Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-29 17:10 +0200
        Re: Javascript injection Aleksandro <aleksandro@gmx.com> - 2016-08-30 16:35 -0300
          Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-31 10:25 +0200
            Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-31 12:43 +0200

#31202 — Javascript injection

If I have a "forum" type of site, where stuff is being posted, and stored in the backend (in a MySQL database, using PHP), say,....can anyone type in Javascript into the post to accomplish naughty things? What's the most nefarious thing anyone can do? All I can think of is that someone would deface the page somehow, that *that* post is on, which, really, I can't see the point of..... Anything else?
...and how do I protect against it? (the post will probably be displayed inside a DIV on the page, I think....)


Thanks.

[toc] | [next] | [standalone]

#31204

On 29.08.2016 at 07:58, bit-naughty@hotmail.com wrote:

> If I have a "forum" type of site, where stuff is being posted, and stored in the backend (in a MySQL database, using PHP), say,....can anyone type in Javascript into the post to accomplish naughty things? What's the most nefarious thing anyone can do? All I can think of is that someone would deface the page somehow, that *that* post is on, which, really, I can't see the point of..... Anything else?
> ...and how do I protect against it? (the post will probably be displayed inside a DIV on the page, I think....)

I suggest you read about Cross-Site-Scripting (XSS), for a start.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#31208

On Sun, 28 Aug 2016 22:58:08 -0700 (PDT),
bit-naughty@hotmail.com wrote:

>If I have a "forum" type of site, where stuff is being posted, and stored in the backend (in a MySQL database, using PHP), say,....can anyone type in Javascript into the post to accomplish naughty things? What's the most nefarious thing anyone can do? All I can think of is that someone would deface the page somehow, that *that* post is on, which, really, I can't see the point of..... Anything else?
>...and how do I protect against it? (the post will probably be displayed inside a DIV on the page, I think....)

I would not even allow ordinary users to enter HTML tags, i.e.
have them filtered out. This, of course, includes <script ...>
tags, so users cannot inject any script.

Hans-Georg

[toc] | [prev] | [next] | [standalone]

#31209

Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> wrote on 29 Aug
2016 in comp.lang.javascript: 

> On Sun, 28 Aug 2016 22:58:08 -0700 (PDT),
> bit-naughty@hotmail.com wrote:
> 
>>If I have a "forum" type of site, where stuff is being posted, and
>>stored in the backend (in a MySQL database, using PHP), say,....can
>>anyone type in Javascript into the post to accomplish naughty things?
>>What's the most nefarious thing anyone can do? All I can think of is
>>that someone would deface the page somehow, that *that* post is on,
>>which, really, I can't see the point of..... Anything else? ...and how
>>do I protect against it? (the post will probably be displayed inside a
>>DIV on the page, I think....) 
> 
> I would not even allow ordinary users to enter HTML tags, i.e.
> have them filtered out. This, of course, includes <script ...>
> tags, so users cannot inject any script.

theText = theText.replace(/</g,'&lt;');

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#31218

On 29/08/16 12:10, Evertjan. wrote:
> Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> wrote on 29 Aug
> 2016 in comp.lang.javascript: 
> 
>> On Sun, 28 Aug 2016 22:58:08 -0700 (PDT),
>> bit-naughty@hotmail.com wrote:
>>
>>> If I have a "forum" type of site, where stuff is being posted, and
>>> stored in the backend (in a MySQL database, using PHP), say,....can
>>> anyone type in Javascript into the post to accomplish naughty things?
>>> What's the most nefarious thing anyone can do? All I can think of is
>>> that someone would deface the page somehow, that *that* post is on,
>>> which, really, I can't see the point of..... Anything else? ...and how
>>> do I protect against it? (the post will probably be displayed inside a
>>> DIV on the page, I think....) 
>>
>> I would not even allow ordinary users to enter HTML tags, i.e.
>> have them filtered out. This, of course, includes <script ...>
>> tags, so users cannot inject any script.
> 
> theText = theText.replace(/</g,'&lt;');

Serversidely OT: http://php.net/str_replace

[toc] | [prev] | [next] | [standalone]

#31219

Aleksandro <aleksandro@gmx.com> wrote on 30 Aug 2016 in 
comp.lang.javascript:

> On 29/08/16 12:10, Evertjan. wrote:
>> Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> wrote on 29 Aug
>> 2016 in comp.lang.javascript: 
>> 
>>> On Sun, 28 Aug 2016 22:58:08 -0700 (PDT),
>>> bit-naughty@hotmail.com wrote:
>>>
>>>> If I have a "forum" type of site, where stuff is being posted, and
>>>> stored in the backend (in a MySQL database, using PHP), say,....can
>>>> anyone type in Javascript into the post to accomplish naughty things?
>>>> What's the most nefarious thing anyone can do? All I can think of is
>>>> that someone would deface the page somehow, that *that* post is on,
>>>> which, really, I can't see the point of..... Anything else? ...and how
>>>> do I protect against it? (the post will probably be displayed inside a
>>>> DIV on the page, I think....) 
>>>
>>> I would not even allow ordinary users to enter HTML tags, i.e.
>>> have them filtered out. This, of course, includes <script ...>
>>> tags, so users cannot inject any script.
>> 
>> theText = theText.replace(/</g,'&lt;');
> 
> Serversidely OT: http://php.net/str_replace

You better [for this NG] use ASP + Jscript, making my suggestion ON topic.



-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#31220

On 31.08.2016 at 10:25, Evertjan. wrote:

> Aleksandro <aleksandro@gmx.com> wrote on 30 Aug 2016 in 
> comp.lang.javascript:
> 
>> On 29/08/16 12:10, Evertjan. wrote:
>>> Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> wrote on 29 Aug
>>> 2016 in comp.lang.javascript: 
>>>
>>>> On Sun, 28 Aug 2016 22:58:08 -0700 (PDT),
>>>> bit-naughty@hotmail.com wrote:
>>>>
>>>>> If I have a "forum" type of site, where stuff is being posted, and
>>>>> stored in the backend (in a MySQL database, using PHP), say,....can
>>>>> anyone type in Javascript into the post to accomplish naughty things?
>>>>> What's the most nefarious thing anyone can do? All I can think of is
>>>>> that someone would deface the page somehow, that *that* post is on,
>>>>> which, really, I can't see the point of..... Anything else? ...and how
>>>>> do I protect against it? (the post will probably be displayed inside a
>>>>> DIV on the page, I think....) 
>>>>
>>>> I would not even allow ordinary users to enter HTML tags, i.e.
>>>> have them filtered out. This, of course, includes <script ...>
>>>> tags, so users cannot inject any script.
>>>
>>> theText = theText.replace(/</g,'&lt;');
>>
>> Serversidely OT: http://php.net/str_replace
> 
> You better [for this NG] use ASP + Jscript, making my suggestion ON topic.

ACK.  However, the OP mentions:

| If I have a "forum" type of site, where stuff is being posted, and
| stored in the backend (in a MySQL database, using PHP) […]

Therefore this newsgroup is somewhat OT anyway.  Therefore, FUP2 c.l.php.

BTW: don't use str_replace() in this case; use htmlspecialchars() with
the appropriate $encoding.  Consider to also use strip_tags().

-- 
Christoph M. Becker

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web