CODEWITHSUNDEEP
phpmysqlhtml
Hirvesh
Hirvesh

Reputation: 7982

Does I need to use HTML Purifier If I'm stripping tags/converting them to HTML entities?

I'm current working on a project where data is read from a textarea and fed to a mysql database. My question is do I really need to use html purifier to prevent mysql injections or whatever attacks if I'm already stripping html tags or converting them to entities?

Upvotes: 1

Views: 463

Answers (2)

user1115652
user1115652

Reputation:

To protect against mysql injections you should use prepared statements.

For other attacks, well for XSS you need to do proper output escaping. That is a bit more of a piece of cake. Matt Robinson wrote a good introduction to the concept. Pádraic Brady points out that it isn't as simple as that and eventually proposes to use a wrapper around htmlspecialchars like Twig do. Zend also has an escaping library and they are both inspired on the reference code from ESAPI which unfortunately does not have a production ready version for php.

Note that all libraries let the comma pass through in javascript context which I think is a vulnerability.

If you don't want to accept html input and you are OK with just stripping out the html tags, you don't need to use an html purifier.

Upvotes: 2

delphist
delphist

Reputation: 4549

You need to add escaping quotes ' (addslashes php function).

Upvotes: 0

Related Questions