Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63205
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lsces.co.uk from 213.123.26.185 cause and error)
Message-ID: <505B2299.7060703@lsces.co.uk>
Date: Thu, 20 Sep 2012 15:05:13 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120826 Firefox/15.0 SeaMonkey/2.12
MIME-Version: 1.0
To: PHP internals <internals@lists.php.net>
References: <505AEB97.8010303@lsces.co.uk> <CALwr1GkYQ9D1ucU_dL2hBoDNKaei+wA8Q=sD=VaGC=LakBjuHg@mail.gmail.com> <505B124A.8070309@lsces.co.uk> <CAPwsocFUeCaPG-sx5fuGh__bkJPdV7k25NcXpnJkyvNK+ZBWfg@mail.gmail.com> <CAH-PCH5UDvWZRq62V3YF+msap=ia62_zAStr0Sz2MzbWKsHzaQ@mail.gmail.com>
In-Reply-To: <CAH-PCH5UDvWZRq62V3YF+msap=ia62_zAStr0Sz2MzbWKsHzaQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Decode, transcode, sanitize, filter, escape
From: lester@lsces.co.uk (Lester Caine)

Ferenc Kovacs wrote:
>      > My whole point here is identifying WHAT needs 'escaping'. You can't simply
>      > 'escape' the output stream, you still want html tags to get out?
>
>     This problem is specific to YOU, because (as far as I understood your
>     previous post) you decided to store big chunks of HTML in your data
>     store. It is not a problem with this proposal, or a problem in
>     general.
>
> more specifically: accepting HTML, but trying to allow some of the tags but
> still filtering most of it.
> HTMLPurifier is the tool for this kind of job, but most people would recommend
> using some kind of alternative markup format, like BBCode
> <http://en.wikipedia.org/wiki/BBCode>.

Which is another possible solution to the overall problem. Filter the incoming 
data in a different way :) I'm more than happy with my OWN methods of handling 
this problem, I was just point out that a LOT of people find ckeditor or one of 
the html in-line editors and think that is a good way to go ... that was how I 
started several years ago ... so I'm just putting my hand up and saying that 
simply creating an 'anti-XSS escaping class' may not work for some people. It is 
the whole package that is important.

( That is another tack on this was well Paddy )

-- 
Lester Caine - G8HFL
-----------------------------
Contact - http://lsces.co.uk/wiki/?page=contact
L.S.Caine Electronic Services - http://lsces.co.uk
EnquirySolve - http://enquirysolve.com/
Model Engineers Digital Workshop - http://medw.co.uk
Rainbow Digital Media - http://rainbowdigitalmedia.co.uk