Databases
StackOverflow2013
Postsdbo
POIs strip_tags() vulnerable to scripting attacks?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs strip_tags() vulnerable to scripting attacks?
    primarykey
    data
    text
    <p>Is there a known XSS or other attack that makes it past a </p> <pre><code>$content = "some HTML code"; $content = strip_tags($content); echo $content; </code></pre> <p>?</p> <p>The <a href="http://php.net/strip_tags" rel="nofollow noreferrer">manual</a> has a warning:</p> <blockquote> <p>This function does not modify any attributes on the tags that you allow using allowable_tags, including the style and onmouseover attributes that a mischievous user may abuse when posting text that will be shown to other users.</p> </blockquote> <p>but that is related to using the <code>allowable_tags</code> parameter only.</p> <p><strong>With no allowed tags set</strong>, is <code>strip_tags()</code> vulnerable to any attack?</p> <p><a href="http://shiflett.org/articles/foiling-cross-site-attacks" rel="nofollow noreferrer">Chris Shiflett</a> seems to say it's safe:</p> <blockquote> <p>Use Mature Solutions</p> <p>When possible, use mature, existing solutions instead of trying to create your own. Functions like strip_tags() and htmlentities() are good choices.</p> </blockquote> <p>is this correct? Please if possible, quote sources.</p> <p>I know about HTML purifier, htmlspecialchars() etc.- I am <strong>not</strong> looking for the best method to sanitize HTML. I just want to know about this specific issue. This is a theoretical question that came up <a href="https://stackoverflow.com/questions/5788314">here</a>.</p> <p>Reference: <a href="http://lxr.php.net/opengrok/xref/PHP_5_3/ext/standard/string.c#php_strip_tags_ex" rel="nofollow noreferrer"><code>strip_tags()</code> implementation in the PHP source code</a></p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USPekka 웃
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POIs strip_tags() vulnerable to scripting attacks?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POIs strip_tags() vulnerable to scripting attacks?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POIs strip_tags() vulnerable to scripting attacks?
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWell, no arguments given, it strips out _all_ tags, so I don't see how there could be any exploit. The worst thing to happen would be someone feeding you invalid markup (no closing tags), but this worst case will simply mean that `strip_tags` strips out a lot more text.
      singulars
      1. POIs strip_tags() vulnerable to scripting attacks?
      1. USDamon
    2. CO@Gordon thanks, but I mean a whole chunk of HTML data only, so no injected file names etc. (which if I understand it right, is what the forum entry is discussing.) as far as I can see, the thread doesn't prove a vulnerability in strip_tags(), but goes on to recommend htmlspecialchars() - which is what I usually do as well, but I want to know whether it's really *necessary*
      singulars
      1. POIs strip_tags() vulnerable to scripting attacks?
      1. USPekka 웃
    3. COYou can check the way `strip_tags` works by looking at [the implementation](http://lxr.php.net/opengrok/xref/PHP_5_3/ext/standard/string.c#php_strip_tags_ex).
      singulars
      1. POIs strip_tags() vulnerable to scripting attacks?
      1. USLekensteyn
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload