CODEWITHSUNDEEP
coldfusionxsscoldfusion-10
user3427540
user3427540

Reputation: 1172

How to prevent script tags and other XSS entities from being inserted into the db?

I have a form which contains many text boxes. All the text boxes are required fields. As these are textboxes I can not use specific validation except the length. But i do not want to allow the users to insert tags that are vulnerable to xss attacks.

I know in ColdFusion i can use htmlEditFormat(),encodeForHTML() while displaying user data for preventing XSS, But I just want to prevent those from inserting to db.'GlobalScriptProtect' option also does not add much security as per my knowledge. As I am in CF10, so can not use getSafeHTML()

Is there any way to prevent theses malicious inputs from inserting into the DB in CF10. Can I go for client side sensitization ?

Upvotes: 1

Views: 209

Answers (1)

Sollinger04
Sollinger04

Reputation: 405

There is a UDF on CFlib.org isXss that checks a value to determine if it is xss. I have used this function and built a custom tag to check every form field and query string field before I submit it to the database. After implementing this, I have been able to pass countless PCI scans and have not had any xss issues.

Upvotes: 5

Related Questions