Download
2012-08-31, 01:24:47
michaellindahl Wrote:Dear GS Blog developer:
Quote:Are you sure that the posts are html entity encoded? And are you sure you really want to decode them? Most of the times you can just get away with htmlspecialchars(). And decoding before displaying is often a bad idea and may introduce XSS vulnerabilities. Not sure in you specific case though. Just a reminder to watch what you are doing :-) E.g. are you sure you want to decode it and not encode it to prevent XSS?
That's not really the proper way to filter user input anyway. I most certainly would not use entity encoding decoding as a xss filter mechanism. Shouldn't all authors be trusted anyway or are you referring to rss feeds ?
