Reply to thread

Message

<blockquote data-quote="BIOS" data-source="post: 466723" data-attributes="member: 15674">[URL unfurl=&quot;true&quot;]https://github.com/TheLaxus/Hylib/blob/63190a08d52eaecd286a52f9c04c07ddb5d8d461/configuration/class/class.functions.php#L41-L69[/URL][CODE=php]&nbsp; &nbsp; &nbsp; &nbsp; static function Filter($type, $string) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if ($type == 'XSS' || $type == 'xss') {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $value = htmlspecialchars_decode($string);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $value = trim($value);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 18&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $search = [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;script&quot;, &quot;/script&gt;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;div&quot;, &quot;/div&gt;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;a&quot;, &quot;/a&gt;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;button&quot;, &quot;/button&gt;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;?php&quot;, &quot;?&gt;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;?=&quot;, &quot;?&gt;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;svg&quot;, &quot;/svg&gt;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&lt;link&quot;, &quot;&lt;?xml&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $replace = [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &quot;&quot;, &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $value = str_replace($search, $replace, $value);[/CODE]Don't do this to prevent XSS, it's the least effective way to go about it. What about img tags? Or literally any invalid character tag? There's too many permutations to be able to &quot;replace&quot; known-bad.Instead use an actual template engine like Twig which has built in escaping: <a href="https://twig.symfony.com/doc/2.x/filters/escape.html" target="_blank">https://twig.symfony.com/doc/2.x/filters/escape.html</a>Or if you want to stick to vanilla PHP, use htmlentities for 99% of cases, and htmlspecialchars. That entire code block can pretty much be replaced with a one line htmlentities($string) and do a much better job.</blockquote>

[QUOTE="BIOS, post: 466723, member: 15674"] [URL unfurl="true"]https://github.com/TheLaxus/Hylib/blob/63190a08d52eaecd286a52f9c04c07ddb5d8d461/configuration/class/class.functions.php#L41-L69[/URL] [CODE=php] static function Filter($type, $string) { if ($type == 'XSS' || $type == 'xss') { $value = htmlspecialchars_decode($string); $value = trim($value); # 18 $search = [ "<script", "/script>", "<div", "/div>", "<a", "/a>", "<button", "/button>", "<?php", "?>", "<?=", "?>", "<svg", "/svg>", "<link", "<?xml" ]; $replace = [ "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "" ]; $value = str_replace($search, $replace, $value);[/CODE] Don't do this to prevent XSS, it's the least effective way to go about it. What about img tags? Or literally any invalid character tag? There's too many permutations to be able to "replace" known-bad. Instead use an actual template engine like Twig which has built in escaping: [URL]https://twig.symfony.com/doc/2.x/filters/escape.html[/URL] Or if you want to stick to vanilla PHP, use htmlentities for 99% of cases, and htmlspecialchars. That entire code block can pretty much be replaced with a one line htmlentities($string) and do a much better job. [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members