GS Blog v1.4

[michaellindahl]

Dear GS Blog developer:

Are you sure that the posts are html entity encoded? And are you sure you really want to decode them? Most of the times you can just get away with htmlspecialchars(). And decoding before displaying is often a bad idea and may introduce XSS vulnerabilities. Not sure in you specific case though. Just a reminder to watch what you are doing :-) E.g. are you sure you want to decode it and not encode it to prevent XSS?

That's not really the proper way to filter user input anyway. I most certainly would not use entity encoding decoding as a xss filter mechanism. Shouldn't all authors be trusted anyway or are you referring to rss feeds ?

I'm not quite sure on the security front, but the GS Blog developer does tell users to use it:

Create Excerpt: <?php echo $Blog->create_excerpt(html_entity_decode($post->content), 0, $excerpt_length); ?>
This will create an excerpt of specified length. The $excerpt_length variable would need to be an integer and is the length of the excerpt.