473,608 Members | 1,821 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

php sees html input as a code

57 New Member
Hi everybody.I'm recently working with PHP and i've made a mini forum page(usable) and when I put it in test,I obviously used commas,periods and others, it treats those symbols as codes.And I think this would result an XSS vulnerablity when launched in the future.How can I prevent this from happening?
Dec 21 '15 #1
4 1641
Claus Mygind
571 Contributor
Most likely you are not separating your php code from your html code. But there really is no way to answer your question because you did not show us your code. Would like to have been of more help.
Dec 21 '15 #2
Toxicous8
57 New Member
Okay lemme just write a simple sample of the code.
Expand|Select|Wrap|Line Numbers
  1.  <form method="POST" action="<?php $_PHP_SELF ?> "> 
  2. <input name="test" /> 
  3. <input type="submit" /> 
  4. <form> 
  5.  
  6. <?php
  7.  
  8. $test = $_POST['test']; 
  9.  
  10. echo 'You wrote '.$test.'!'; 
  11.  
  12. ?> 
  13.  
  14.  
  15.  
Feb 1 '16 #3
Claus Mygind
571 Contributor
Ok first a few minor errors in your code, but since it is just an example that does not really matter.

Exploitation of your code is not possible when the page is streamed out, because the periods and other PHP command codes you insert in your page are not streamed out to the client machine.

From your example
Expand|Select|Wrap|Line Numbers
  1.  <?php
  2.  
  3. $test = $_POST['test']; 
  4.  
  5. echo 'You wrote '.$test.'!'; 
  6.  
  7. ?> 
the streamed out page would not include any of the php code
ie: echo, the single quotes, ., or even the variable $test.

The only thing the user would see and have access to would be
You wrote something where something is the content of the variable $test.

To exploit your page the hacker would have to inject some code into one of your input fields.

It may be helpful for you to read this link

PHP code is not exposed to the user like javaScript. So you have no concern here.
Feb 2 '16 #4
Dormilich
8,658 Recognized Expert Moderator Expert
notes:
- $_PHP_SELF, not sure where you get that, but if you copy it over from $_SERVER['PHP_SELF'] you have an XSS vulnerability. better use $_SERVER['SCRIPT_NAME']
- the self-closing tags (/>) are invalid in HTML, though browsers conveniently ignore that

and a personal preference, semantically it makes more sense to write the submit button as button (<button type="submit">… </button>). it has the advantage that you cannot confuse it with an input box and you have better control of the content (<input> only allows text, <button> allows HTML)
Feb 3 '16 #5

Sign in to post your reply or Sign up for a free account.

Similar topics

1
1192
by: anonymou | last post by:
I have a portal-like site where I cannot use the @ Page validateRequest=false approach for bypassing HTML input because it would affect all pages of the site. Does anyone have a work-around for allowing HTML input only on specific boxes? I was thinking I could encode the content before it is posted to the server. Thank you in advance.
0
1350
by: darren | last post by:
When using the html input file (input type=file), is there anyway to NOT have the file loaded on the server? I am only interested in using this control to browse to a file and then get the filename, but when the form posts the file ends up on the server. I am using a popup window with 4 input file controls on it, and just want to return the file names to the parent window when the popup window closes, I don't want the files loaded. Is...
2
1384
by: Robin | last post by:
On an ASP.Net web page that has a HTML Input file control run on the server side, is there any setting that limits the size of the file that can be uploaded? Is there any validation code that runs when the value of this type of control is selected?
15
4741
by: Nathan | last post by:
I have an aspx page with a data grid, some textboxes, and an update button. This page also has one html input element with type=file (not inside the data grid and runat=server). The update button will verify the information that has been entered and updates the data base if the data is correct. Update will throw an exception if the data is not validate based on some given rules. I also have a custom error handling page to show the...
1
1524
by: Owen Wong | last post by:
Please look at my newly written class. It is meant to be used to filter suspicious html input from an online html editor. I need help about 2 things: 1. Does it need to filter more things? Which I think is of course needed although I don't know where to improve. 2. You see I try to filter any link. If the target address is not started with "http://" or "mailto:", it will be replaced with an empty string. But I think the code I wrote can...
3
2746
by: vishnu | last post by:
Hi, I am using HTML input file button to browse the file and just am updating the file name in sql server table.But now i want to browse the file from the remote file share path ..How can i specify this path in HTML input button.Is there anyway to open the file from the specified path instead of opening local directory? Thanks,
2
3189
by: RajasScripts | last post by:
Hi I need some guidance in sorting HTML input tag sorting.I am able to sort columns with out input tag and with dates.But the only problem is I am not able to sort a column which is text box with Numbers.I am using sorttable.js file which i got from website. This one is working fine with all the column but not with input tag (I mean text box where user enter Numerical value) Regards Raja
4
13294
by: Chris | last post by:
Hi, i 'm experimenting with postback and i tried that with a button server control and an Html input button but with runat="server". The button server control causes a postback, but not the Html input button with runat="server". Can someone explain me why (because it's running on the server)? Thanks
1
1623
by: tariqahmedpak | last post by:
Hi to All I need to ask that i have HTML Input File Server Control on the page (ASP.NET 2.0) when i browse the file and then in the code behind when i try to apply method HasFile it gives false means no file selected but i have selected a file. Please help me in this problem.
3
4114
by: coolnags | last post by:
Hi, I have created 2 html input text boxes with readonly property set to 'readonly'. I am handling the esc key event(27) in javascript code. When I press the esc key for the first time it will not harm any thing. But if i press the esc key 2nd time it will clear both the input text box values. Please let me know is this the correct behavior? What should I do to retain the text values? Thanks, Nags
0
8071
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
8503
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
8488
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
0
8360
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
6831
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
4039
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
2482
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
1
1613
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
0
1345
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.