CODEWITHSUNDEEP
phpmysqlsqlcontent-management-systemxss
Jack27696
Jack27696

Reputation: 21

How to store user content while avoiding XSS vulnerabilities

I know similar questions have been asked but I am struggling to work out how to do it.

I am building a CMS, rather primitive right now, but it's as a learning exercise; in a production site, I would use an existing solution for sure.

I would like to take user input, which can be styled in a WYSIWYG editor. I would also like them to be able to insert images inline.

I understand I can store HTML in the database but how can I safely re-render this. I know there is no problem with the HTML being stored but it is my understanding that XSS become an issue if I were to just simply dump the user-generated code onto a layout template.

So the question put simply, is how can I store and safely rerender user content in cms? I am using Laravel and PHP. I also have a little knowledge of javascript if its required.

Upvotes: 0

Views: 213

Answers (2)

fgb
fgb

Reputation: 18559

For a CMS where you want to allow some tags but not others, then you want something like HTML Purifier. This will take HTML and run it against a whitelist and regenerate HTML that is safe to display back to the user.

Upvotes: 1

O. Jones
O. Jones

Reputation: 108816

A good and cheap way to avoid cross-site scripting is to get your php program to entitize everything from your users' input before storing it in the database. That is, you want to take this entry from a user

Hi there sucker! I just hacked your site.
<script>alert('You have been pwned!')</script>

and convert it to this before putting it into your database.

Hi there sucker! I just hacked your site.
&lt;script&gt;alert('You have been pwned!')&lt;/script&gt;

When you pass &lt; to a browser, it renders it as <, but it doesn't do anything else with it.

The htmlentities() function can do this for you. And, php's htmlspecialchars_decode() can reverse it if you need to. But you shouldn't reverse the operation unless you absolutely must do so, for example to load the document into an embedded editor for changes.

You can also choose to entitize user-furnished text after you retrieve it from your database and before you display it. If you get to the point where several people work on your code, you may want to do both for safety.

You can also render user-provided input inside <pre>content</pre> tags, which tells the brower to just render the text and do nothing else with it.

(Use right-click Inspect on this very page to see how Stack Overflow handles my malicious example.)

Upvotes: 1

Related Questions