Welcome Guest, Not a member yet? Register   Sign In
Is input->post meant to strip tabs?
#5

(09-04-2017, 11:52 PM)n2fole00 Wrote:
(09-04-2017, 09:35 AM)InsiteFX Wrote: You could try this, not tested.

PHP Code:
$this->input->post(htmlspecialchars('tabbed_content')); 

Yes, that worked

There's absolutely zero reason for that to "work". It is the equivalent of:

Code:
$input_name = htmlspecialchars('tabbed_content'); // returns 'tabbed_content' ... zero change
$this->input->post($input_name);

That doesn't help, in any imaginable way. What did work is you changing $config['global_xss_filtering'] to FALSE and/or not using xss_clean() on the contents.

(09-04-2017, 11:52 PM)n2fole00 Wrote: but it's still confusing because htmlspecalcharacters reportedly doesn't perform translations on backslashes.

There are no backslashes to be "translated". We write "\n", "\t", etc. while we code because that's the notation programming languages use to denote whitespace characters, for code that is easier to both read and write. But there are no actual backslashes in those characters.

(09-04-2017, 11:52 PM)n2fole00 Wrote: Edit: does htmlspecialchars() act as a good replacement for xss_clean, because I just found I am having the same issue with that too. I could of course run some tests, but perhaps you already know the answer Tongue

Depends on the context. If it is rendered within HTML, as regular text - yes, it's fine.

But you can't run tests to determine this. You can run tests to determine if your test content is rendered correctly, but given that you don't know how htmlspecialchars() works in the first place, you couldn't possibly test it for XSS vulnerabilities.
Security isn't about what works as intended in the boring everyday scenarios; it's about what happens when someone intentionally uses your stuff in ways you didn't anticipate.
Reply


Messages In This Thread
Is input->post meant to strip tabs? - by n2fole00 - 09-04-2017, 08:24 AM
RE: Is input->post meant to strip tabs? - by Narf - 09-05-2017, 03:34 AM



Theme © iAndrew 2016 - Forum software by © MyBB