Re: [PHP] Preventing XSS Attacks

Ashley Sheridan wrote:
> On Wed, 2009-06-10 at 23:05 +0530, Sudheer Satyanarayana wrote:
>   
>>> I've been doing a bit of reading, and I can't really understand why XSS
>>> is such an issue. Sure, if a user can insert a <script> tag, what
>>> difference will that make to anyone else, as it is only on their own
>>> browser.
>>>   
>>>       
>> 1. User 1 logs on to the application. Fills up the form with malicious 
>> JS code in it. The server accepts the input, is stored in the database.
>> 2. User 2 logs on to the application. Goes to the view the information 
>> stored in the database. The JS gets executed on user 2's browser. User 
>> is attacked by XSS.
>>
>> I hope that clarifies the question.
>>
>>
>>     
> It does to a degree. So I shouldn't really worry about it in this case,
> as input from one user will never be displayed to any other user. If it
> was a forum or something, it would, but the search string is only ever
> shown to the user who entered it, and never stored for later display.
>
>   
It is easy to slip by. I recall a website was hacked using XSS on the 
page the admin views the log entries. Just in case, you or somebody else 
tries to add the search log feature in the future, keep this at the back 
of your mind. Having the user to click on a harmful URI is ridiculously 
easy.

 


-- 

With warm regards,
Sudheer. S
Business: http://binaryvibes.co.in, Tech stuff: http://techchorus.net, Personal: http://sudheer.net