Security question

[Loccie]

I just wrote a little BB coding system and I'm going to add security to it now. I wanted to know if removing 'javascript:' is enough. This should prevent javascript injections right? SQL injections should be blocked already since I'm using prepared statements.

[DFox]

Preventing "JavaScript" injections has nothing to do with removing javascript:. Just worry about turning brackets into entities (htmlentities()), that way a JavaScript tag can never be interpreted...

[Deja-Vu]

Run the text through at least strip_tags() and htmlentities()

[Loccie]

At 5/7/09 09:26 AM, DFox wrote: Preventing "JavaScript" injections has nothing to do with removing javascript:. Just worry about turning brackets into entities (htmlentities()), that way a JavaScript tag can never be interpreted...

I don't know what I was thinking, htmlentities() is so obvious. Thanks.

At 5/7/09 12:52 PM, Deja-Vu wrote: Run the text through at least strip_tags() and htmlentities()

I don't understand the need for strip_tags(). I mean, don't all the tags get converted by htmlentities() to normal text?

[X8X]

At 5/7/09 01:10 PM, Loccie wrote: I don't understand the need for strip_tags(). I mean, don't all the tags get converted by htmlentities() to normal text?

Yes they do, if you use htmlentities(), there's no need for strip_tags(). Strip_tags() only removes stuff like: <script> (which will then already be turned into normal text).

strip_tags() also makes it impossible for somebody to post code for other people to view, since the entire content between the tags will also be stripped.