Help, I'm cross-site-scriptable :)

promeus

HI guys,

My site allows users to type in absolutely anything they want into a couple of textarea forms. In a way, its kind of like a forum in that you can type in anything that comes to mind. However, when I enter in html, I can make it create popups and links for people to click on and I think that's probably a bad idea. I have user-sessions to protect, etc. I've read some stuff on it, and they suggest protecting against <script> and <iframe> tags and the like, but what if they feel like talking about html? Maybe they'll want to post some javascript or something? What's a good way to allow complete chaos in a textarea or other form element and still keep my site and my users safe?

Thanks!

promeus

I'm sure folks will ask what's my implimentation. I accept user input via the POST method, and essentially print out the contents of $_POST['var']

I do use my own cleaning function, one of the ones available on php.net in the function descriptions (I only use it when I do inserts into the database). I have magic quotes turned off.

Thanks again.

NogDog

If you just want to show the HTML code as opposed to allowing it to actually take effect:

echo htmlspecialchars($_POST['var']);

promeus

That's news to me 🙂 Cool function. Question then, would you recommend against printing ALL of my output from these textareas using this function? Would there be some unkown harm? For example:

$userInput = htmlspecialchars($_POST['user_input']);
print "<h1>$userInput</h1>";

Thanks again, totally appreciate it.

MarkR

Every single string which is output inside html should have htmlspecialchars() run on it.

The only exception to this is where you KNOW that SAFE html only is present in the string, and actually WANT it to be injected into the page.

Cleaning HTML to be safe from script injection is nontrivial.

Even if you aren't worried about XSS (e.g. the user who submitted the HTML is trusted), a non-malicious but careless user could easily put in some HTML which will wreck the page it's contained in.

Mark

dougal85

How can you allow certain HTML tags? for example, if you want to allowthe font tag.

you don't know what attributes it will have... so i cant get my head around that.

MarkR

In order to only allow certain tags, you need to parse the HTML into tags, attributes, then remove the unwanted ones and reassemble the HTML again.

This is nontrivial.

To make matters worse, there are some attributes that you probably want to allow, that need their values filtering against certain patterns (blacklist or whitelist).

As I said before, it's nontrivial.

Mark

NogDog

You could use the [man]strip_tags[/man] function to strip all tags except those you list in its second parameter; but it still has a problem with not doing anything about the attributes within the allowed tags, so a malicious user could include a javascript event (onmouseover, etc.) within the tag. (It may also do unexpected/unwanted things if the html being passed to it is malformed.)