+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] htmlspecialchars() tutotrial for beginners ~[Step by Step | Pictures]~ (/showthread.php?tid=3119528)
Pages: Pages
1
2
htmlspecialchars() tutotrial for beginners ~[Step by Step | Pictures]~ - ~[DogiD]~ - Dec 24, 2012
Here is my tutorial how to setup htmlspecialchars() and protect your site to xss vulnerability.
If you didn't know what XSS vulnerability is then i recommend you read this tutorial first, https://hackforums.net/showthread.php?tid=2910051
What you need, before you start read tutorial?
- Website or other think to run php files (ex. XAMPP)
- Notepad++ or other program to edit php files.
Steps,
- First make 2 php file, "index.php" and "without.php".
Open "index.php" and build simple form page. Like this,
Spoiler (Click to View)
- When "index.php" is ready, open "without.php" file and make it looks like this,
Spoiler (Click to View)
- Now when you type something in "index.php" its send it to "without.php" page. So if i type in textbox script,
Code<script>alert(1)</script>
Then i press send..
Spoiler (Click to View)
- Now we just need add htmlspecialchars() function in "without.php" file,
Spoiler (Click to View)
- Lets try again, what happen if i try send same script,
Spoiler (Click to View)
- Now htmlspecialchars() function change all <, > etc to html code and xss vulnerability is fixed.
Congratulations! 🎉
Hope this tutorial help you understand how to use htmlspecialchars() function,
Good luck and have fun!
~ DogiD🤝
* - LevelUp - Dec 24, 2012
Very nice tutorial, well explained mate.
* - redpois0n - Dec 24, 2012
thank you for this! Well explained and confirmed what I knew :)
Using this for my site
* - ~[DogiD]~ - Dec 24, 2012
(Dec 24, 2012 05:40 AM)redpois0n Wrote: thank you for this! Well explained and confirmed what I knew :)
Using this for my site
Good to hear ;)
Thank you,
~ DogiD🤝
* - ıllı LυςкY ıllı - Dec 24, 2012
Have learned a good thing. Thanks for the share.
* - what else? - Dec 24, 2012
You forgot to mention htmlspecialchars is only used while parsing the content.
Do not use htmlspecialchars then save a content to a db then parse it.
* - GambleSickness - Dec 24, 2012
woow very good and detailed tutorial , many have knowledge leak when it comes to these stuff ...
* - alexlandonflicksss - Dec 24, 2012
Nice tut....it will be better...if this was a video...
* - Volim te - Dec 24, 2012
I use htmlentities() myself but great tut anyway.
* - VoidEx. - Dec 24, 2012
(Dec 24, 2012 10:15 AM)what else? Wrote: You forgot to mention htmlspecialchars is only used while parsing the content.
Do not use htmlspecialchars then save a content to a db then parse it.
Yes this exactly.
However I myself do use htmlspecialchars when saving to db for certain things, such as usernames for my website. This is fine. Otherwise, parse on output is the recommended practice.
(Dec 24, 2012 08:23 PM)Jebi se Wrote: I use htmlentities() myself but great tut anyway.
If you allow certain tags with htmlentities(), eg <b>, ensure that you are aware of the fact that people can still execute scripts.
Eg:
<b onload='alert(1)'></b>
To the OP:
Well done and thanks for the tutorial :) This should help a lot of people secure their websites.
* - KernelMode - Dec 24, 2012
Why make this thread? You can just look at php's site. http://php.net/manual/en/function.htmlspecialchars.php
* - Volim te - Dec 24, 2012
(Dec 24, 2012 08:27 PM)Ѻne™ Wrote: Yes this exactly.I mostly add a number is `disallowed` words like javascript, onload, onerror ,document.cookie etc.
However I myself do use htmlspecialchars when saving to db for certain things, such as usernames for my website. This is fine. Otherwise, parse on output is the recommended practice.
If you allow certain tags with htmlentities(), eg <b>, ensure that you are aware of the fact that people can still execute scripts.
Eg:
<b onload='alert(1)'></b>
To the OP:
Well done and thanks for the tutorial :) This should help a lot of people secure their websites.
* - PigBacon - Dec 24, 2012
(Dec 24, 2012 08:27 PM)Ѻne™ Wrote: However I myself do use htmlspecialchars when saving to db for certain things, such as usernames for my website. This is fine. Otherwise, parse on output is the recommended practice.
You know why its the recommended practice?
Because it makes sense.
You should never store escaped data, I mean, what if you want to export it to a CSV file, you'll have HTML escapes all over.
* - RebornX - Dec 24, 2012
On the 5th step the image should say "With htmlspecialchars()" ithink.
Nice tutorial though :)
* - badbrains - Dec 24, 2012
.. You made a tutorial for a DOCUMENTED function?
.. Why?
http://php.net/htmlspecialchars