sanitization

Convert a function from preg_replace to preg_replace_callback()

由 烂漫一生 提交于 2019-12-02 22:25:43
问题 I need to convert preg_replace() to preg_replace_callback() in this function of an outdated CMS extension: // santizes a regex pattern private static function sanitize( $pattern, $m = false, $e = false ) { if( preg_match( '/^\/(.*)([^\\\\])\/(.*?)$/', $pattern, $matches ) ) { $pat = preg_replace( '/([^\\\\])?\(\?(.*\:)?(.*)\)/Ue', '\'$1(?\' . self::cleanupInternal(\'$2\') . \'$3)\'', $matches[1] . $matches[2] ); $ret = '/' . $pat . '/'; if( $m ) { $mod = ''; foreach( self::$modifiers as $val

Sanitize (radio buttons, checkboxes and <option>)

由 天涯浪子 提交于 2019-12-02 14:59:48
问题 In PHP, does one have to sanitize these types of inputs: radio buttons, checkbox es and <option> ? Or do only the inputs where the user can enter arbitrary text have to be sanitized? 回答1: The form you send to the client does not, in any way, limit what data they can send back. So, yes, you need to provide sanity checking and suitable escaping for every piece of incoming data. 回答2: Do you use PDO ? If not you need to sanitize them. Especially for <option>any value'here</option> 回答3: In

Can i manipulate an external HTML document with JQuery?

由 倖福魔咒の 提交于 2019-12-02 11:16:08
I would like to sanitize a HTML document (created in google docs) so I can publish it on my CMS. I have the source document in a string, from to , with header, style, body etc. I would like to extract the body content and replace/eliminate a few tags. If I could do this using jQuery I think it would be easier than with more sophisticated html parsers. But when I try to get the body of the document, I don't get usable results. I tried: var gdoc = "<html>...google document...</html>" $(gdoc) //list of text nodes, can not rebuild to document or find body $("body",gdoc) //empty list Is this doable

Convert a function from preg_replace to preg_replace_callback()

由 大憨熊 提交于 2019-12-02 10:26:41
I need to convert preg_replace() to preg_replace_callback() in this function of an outdated CMS extension: // santizes a regex pattern private static function sanitize( $pattern, $m = false, $e = false ) { if( preg_match( '/^\/(.*)([^\\\\])\/(.*?)$/', $pattern, $matches ) ) { $pat = preg_replace( '/([^\\\\])?\(\?(.*\:)?(.*)\)/Ue', '\'$1(?\' . self::cleanupInternal(\'$2\') . \'$3)\'', $matches[1] . $matches[2] ); $ret = '/' . $pat . '/'; if( $m ) { $mod = ''; foreach( self::$modifiers as $val ) { if( strpos( $matches[3], $val ) !== false ) { $mod .= $val; } } if( !$e ) { $mod = str_replace( 'e'

If I only sanitize GET and POST data, will I be safe from injection?

由 元气小坏坏 提交于 2019-12-02 07:43:41
问题 I'm just thinking about the best way to go about sanitizing my data to prevent injection attacks. Some people like to sanitize immediately before output, or immediately before insertion to the database... but the problem I see with this is twofold: (1) what if you miss a paramater/variable? (2) what if you're over-sanitizing? Not that it would hurt the output, but there's not much sense sanitizing stuff you already know is safe. For example, in PHP instead of using $_GET and $_POST couldn't I

If I only sanitize GET and POST data, will I be safe from injection?

由 人盡茶涼 提交于 2019-12-02 04:15:22
I'm just thinking about the best way to go about sanitizing my data to prevent injection attacks. Some people like to sanitize immediately before output, or immediately before insertion to the database... but the problem I see with this is twofold: (1) what if you miss a paramater/variable? (2) what if you're over-sanitizing? Not that it would hurt the output, but there's not much sense sanitizing stuff you already know is safe. For example, in PHP instead of using $_GET and $_POST couldn't I wrap those with something like: function get($var) { return my_sanitizer($_GET[$var]); } Or would that

Sanitizing input but output not as expected

由 孤街浪徒 提交于 2019-12-02 02:40:07
This is one of my forms(PHP+MySQL, textarea replaced by TinyMCE). It records description with paragraphs, bullets, headings and text alignment (right, left, center and justify). Once submitted, the record appears as <p style="text-align: justify;"><strong>Introduction</strong></p> <p style="text-align: justify;">The death of the pixel leaves you with a flowing, magazine-quality canvas to design for. A canvas where curves are curves, not ugly pixel approximations of curves. A canvas that begins to blur the line between what we consider to be real and what we consider to be virtual.</p> <p style

Sanitisation on user input using whitelist

由 点点圈 提交于 2019-12-02 01:02:53
I have this code which sanitises user input on a variable called 'username': $username_clean = preg_replace( "/[^a-zA-Z0-9_]/", "", $_POST['username'] ); if (!strlen($username_clean)){ die("username is blank!"); I want to carry out the same process on each input on this page but I have about 12 different inputs since it is a registering form. Is there an easier way to sanitise and check each input instead of applying preg_replace() and the if statement on each one? If you want to sanitize all of the elements in $_POST , then you could just create a sanitization function and apply it to all the

JavaScript-based X/HTML & CSS sanitization

由 谁说我不能喝 提交于 2019-12-01 20:27:39
问题 Before everyone tells me that I shouldn't do client-side sanitization (I do in fact intend to do it on a client, though it could work in SSJS as well), let me clarify what I'm trying to do. I'd like something, akin to Google Caja or HTMLPurifier but for JavaScript: a whitelist-based security approach which processes HTML and CSS (not already inserted into the DOM of course, which would not be safe, but first obtained in string form) and then selectively filters out unsafe tags or attributes,

JavaScript-based X/HTML & CSS sanitization

由 会有一股神秘感。 提交于 2019-12-01 18:40:27
Before everyone tells me that I shouldn't do client-side sanitization (I do in fact intend to do it on a client, though it could work in SSJS as well), let me clarify what I'm trying to do. I'd like something, akin to Google Caja or HTMLPurifier but for JavaScript: a whitelist-based security approach which processes HTML and CSS (not already inserted into the DOM of course, which would not be safe, but first obtained in string form) and then selectively filters out unsafe tags or attributes, ignoring them or optionally including them as escaped text or otherwise allowing them to be reported to
订阅 sanitization