CODEWITHSUNDEEP
phphtmlcontent-management-systemxss
notQuiteAnExpert
notQuiteAnExpert

Reputation: 35

How dangerous is it to output certain content without escaping it first

Following on from a question I asked about escaping content when building a custom cms I wanted to find out how dangerous not escaping content from the db can be - assume the data ha been filtered/validated prior to insertion in the db.

I know it's a best practice to escape output but I'm just not sure how easy or even possible it is for someone to 'inject' a value into page content that is to be displayed.

For example let's assume this content with HTML markup is displayed using a simple echo statement:

<p>hello</p>

Admittedly it won't win any awards as far as content writing goes ;)

My question is can someone alter that for evil purposes assuming filtered/validated prior to db insertion?

Upvotes: 3

Views: 124

Answers (4)

user166390
user166390

Reputation:

Always escape for the appropriate context; it doesn't matter if it's JSON or XML/HTML or CSV or SQL (although you should be using placeholders for SQL and a library for JSON), etc.

Why? Because it's consistent. And being consistent is also a form of being lazy: you don't need to ponder if the data is "safe for HTML" because it shouldn't matter. And being lazy (in a good way) is a valuable programming trait. (In this case it's also being lazy about avoiding having to fix "bugs" due to changes in the future.)

Don't omit escaping "because it will never contain data that needs to be escaped" .. because, one day, over a course of a number of situations, that assumption will be wrong.

Upvotes: 2

kapa
kapa

Reputation: 78731

If you do not escape your HTML output, one could simply insert scripts into the HTML code of your page - running in the browser of every client that visits your page. It is called Cross-site scripting (XSS).

For example:

<p>hello</p><script>alert('I could run any other Javascript code here!');</script>

In the place of the alert(), you can use basically anything: access cookies, manipulate the DOM, communicate with other servers, et cetera.

Well, this is a very easy way of inserting scripts, and strip_tags can protect against this one. But there are hundreds of more sophisticated tricks, that strip_tags simply won't protect against.

If you really want to store and output HTML, HTMLPurifier could be your solution:

Hackers have a huge arsenal of XSS vectors hidden within the depths of the HTML specification. HTML Purifier is effective because it decomposes the whole document into tokens and removing non-whitelisted elements, checking the well-formedness and nesting of tags, and validating all attributes according to their RFCs. HTML Purifier's comprehensive algorithms are complemented by a breadth of knowledge, ensuring that richly formatted documents pass through unstripped.

Upvotes: 1

Jerzy Zawadzki
Jerzy Zawadzki

Reputation: 1985

It could be, for example, also problem linked with some other vulnerabilities like e.g. sql injection. Then someone would b e able to ommit filtering/validation prior adding to db and display whatever he can.

Upvotes: 1

David
David

Reputation: 210

If you are pulling the word hello from the database and displaying it nothing will happen. If the content contains the <script> tags though then it is dangerous because a users cookies can be stolen then and used to hijack their session.

Upvotes: 0

Related Questions