utf8_decode function question

[Sender]

Hi folks, I read in a security note that something known as a cross-site
scripting attacker can use utf8 encoding and that you could decode data to
prevent this. My site has a few fill in the blanks forms for submission to a
database. Should I be concerned about this and should I be using the utf8
decode function on the data submitted?

TIA
Bill

[Daniel Tryba]

Sender <bl**@blah.com> wrote:

Hi folks, I read in a security note that something known as a cross-site
scripting attacker can use utf8 encoding and that you could decode data to
prevent this.
What if the string is double encoded in anticipating of your decode?
My site has a few fill in the blanks forms for submission to a
database. Should I be concerned about this
You should always be concerned about (all) user input.
and should I be using the utf8 decode function on the data submitted?

IMHO you should escape the string before inserting according to the
rdbm's specs (like using mysql_escape_string() if you use mysql).

--

Daniel Tryba