5

When outputting user input, do you only use htmlspecialchars() or are there are functions/actions/methods you also run? I'm looking for something that will also deal with XSS.

I'm wondering if I should write a function that escapes user input on output or just use htmlspecialchars(). I'm looking for the generic cases, not the specific cases that can be dealt with individually.

strager
  • 88,763
  • 26
  • 134
  • 176
Darryl Hein
  • 142,451
  • 95
  • 218
  • 261

3 Answers3

10

I usually use 

htmlspecialchars($var, ENT_QUOTES)

on input fields. I created a method that does this because i use that a lot and it makes the code shorter and more readable.

Ólafur Waage
  • 68,817
  • 22
  • 142
  • 198
  • 1
    Why the use of `ENT_QUOTES` (rather than `ENT_NOQUOTES` as suggested by me)? – Konrad Rudolph Feb 08 '09 at 21:30
  • 2
    I use ENT_QUOTES for input fields with data from the database. So if the data there has ' or " it will not close the value variable within the input tag. – Ólafur Waage Feb 08 '09 at 21:33
  • 1
    Ólafur: yes, on input fields (or more generally attributes) it makes a certain sense. ;-) – Konrad Rudolph Feb 08 '09 at 21:44
  • +1. Defining your own function to do echo(htmlspecialchars()) with a nice short name takes the pain out of – bobince Feb 09 '09 at 02:11
  • Heres how people hack yours site when you use htmlspecialchars. http://ha.ckers.org/blog/20070327/htmlspecialchars-strikes-again/ – Syntax Feb 10 '09 at 13:47
7

Lets have a quick review of WHY escaping is needed in different contexts:

If you are in a quote delimited string, you need to be able to escape the quotes. If you are in xml, then you need to separate "content" from "markup" If you are in SQL, you need to separate "commands" from "data" If you are on the command line, you need to separate "commands" from "data"

This is a really basic aspect of computing in general. Because the syntax that delimits data can occur IN THE DATA, there needs to be a way to differentiate the DATA from the SYNTAX, hence, escaping.

In web programming, the common escaping cases are: 1. Outputting text into HTML 2. Outputting data into HTML attributes 3. Outputting HTML into HTML 4. Inserting data into Javascript 5. Inserting data into SQL 6. Inserting data into a shell command

Each one has a different security implications if handled incorrectly. THIS IS REALLY IMPORTANT! Let's review this in the context of PHP:

  1. Text into HTML: htmlspecialchars(...)

  2. Data into HTML attributes htmlspecialchars(..., ENT_QUOTES)

  3. HTML into HTML Use a library such as HTMLPurifier to ENSURE that only valid tags are present.

  4. Data into Javascript I prefer json_encode. If you are placing it in an attribute, you still need to use #2, such as

  5. Inserting data into SQL Each driver has an escape() function of some sort. It is best. If you are running in a normal latin1 character set, addslashes(...) is suitable. Don't forget the quotes AROUND the addslashes() call:

    "INSERT INTO table1 SET field1 = '" . addslashes($data) . "'"

  6. Data on the command line escapeshellarg() and escapeshellcmd() -- read the manual

-- Take these to heart, and you will eliminate 95%* of common web security risks! (* a guess)

Darryl Hein
  • 142,451
  • 95
  • 218
  • 261
gahooa
  • 131,293
  • 12
  • 98
  • 101
-5

You shouldn't be cleansing text on output, it should happen on input. I use a filter that filters all input to the application. It is configurable so that it can allow specific tags/data through when needed (say for a wysiwig editor).

You should do as little processing of text on output as possible so that you ensure speed. Processing it once creates a lot less strain then processing it 500,0000 times.

Syntax
  • 1,314
  • 1
  • 7
  • 14
  • I would have agreed with you, except that generally the theory is to only accept input that is valid, but then you still need to escape output. The problem comes in when someone enter's a quote in their username, you escape it for HTML it becomes useless for PDF generation. – Darryl Hein Feb 09 '09 at 21:54
  • Heres the thing though, if you are programming this for the web, how many times will it be viewed on the web verse exported as a PDF. I assume you aren't generating PDF's on the fly on every view. So my point stands strong, in the case of a PHP export you can simply reverse the output. – Syntax Feb 09 '09 at 21:58
  • Well, the rule still stands that you want to store the users data as exact as possible in the database and on output modify it as needed. I work on some sites where 50% of web/HTML and 50% is PDF/Excel/etc. – Darryl Hein Feb 10 '09 at 00:21
  • Those sound more like web applications and not web sites. If I was to decode all output when its called on my site it would create a stupid amount of overhead. Very few websites on the face of the planet need to support xhtml, pdf, and excel at the same time and output to each. Thats not standard – Syntax Feb 10 '09 at 13:45
  • 1. Filter input 2. Escape output http://shiflett.org/blog/2005/feb/my-top-two-php-security-practices – ejunker Jun 17 '09 at 13:53