Alex Rivera | Logout

The 2011 approach to XSS in PHP?

Asked 2011-02-21T20:49:51.127
16

I am trying to get updated on available and appropriate counter-measures that actively reduces the chance of being hit by the XSS train during 2011.

I've googled like never before to find out that there's plenty of libraries available online that's supposed to help out with XSS issues, which proudly and boldly states that "the XSS/SQL injection buck stops here".

I have found that these libraries suffer from at least one of the two following symptoms:

  • The library is so huge that it probably has it's own heartbeat.
  • The library is from the times when Beach boys were playing on the radio.

PHP has been around for some time now and the far-from decent strip_tags is accompanied by functions such as filter_var, among others. I am far from an expert in these security issues and really can't tell whether it will ensure good nights of sleep in the future, or not.

What is my best chance of reducing XSS injections during 2011 without bloating my code, with or without dated libraries ?

php security xss
Edit
Report

1 Answer

7

The best solution is to use a template engine that will not let you output any data as plain HTML unless you explicitly tell it to. If you have to escape things manually, it's way too easy to forget something and leave yourself open to an XSS attack.

If you're stuck without a real template entine, use htmlspecialchars().

answered 2011-02-21T20:52:17.130

Your Answer