Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94130
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain paragonie.com designates 209.85.218.54 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5766D311.6030503@lsces.co.uk>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
	<b9318b90-f850-12a2-459d-8995220922df@gmail.com>
	<20160617202344.2868F1A80C02@dd1730.kasserver.com>
	<CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
	<CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
	<CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
	<CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
	<CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
	<57665E36.60302@lsces.co.uk>
	<CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
	<5766D311.6030503@lsces.co.uk>
Date: Sun, 19 Jun 2016 13:28:30 -0400
Message-ID: <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113cddec9a381a0535a4ea64
Subject: Re: [PHP-DEV] New escaped output operator
From: scott@paragonie.com (Scott Arciszewski)

--001a113cddec9a381a0535a4ea64
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 19, 2016 at 1:14 PM, Lester Caine <lester@lsces.co.uk> wrote:

> On 19/06/16 10:01, Marco Pivetta wrote:
> > This basically means that you lack basic understanding of how escaping
> and
> > user input are to be handled.
> > Most apps out there about getting a bunch of text from the user, then
> > rendering it somewhere else in the app.
> > Cleaning user input just leads to frustration and a big mess in most
> > scenarios, which is why we're all talking about escaping output instead=
.
> > This is not "cleaning" either, it's escaping, which is a non-destructiv=
e
> > and reversible operation (which is why it works so well).
>
> Well we have to disagree ... simply expecting htmlspecialchars() to fix
> all your problems without proper handling of the input text is 'the big
> mess' and there is NO need to simply slap htmlspecialchars() onto
> properly built data so the idea that <?=3D should automatically add it is
> totally pointless!
>
> --
> Lester Caine - G8HFL
> -----------------------------
> Contact - http://lsces.co.uk/wiki/?page=3Dcontact
> L.S.Caine Electronic Services - http://lsces.co.uk
> EnquirySolve - http://enquirysolve.com/
> Model Engineers Digital Workshop - http://medw.co.uk
> Rainbow Digital Media - http://rainbowdigitalmedia.co.uk
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
=E2=80=8BLet me tell you a story.

Once upon a time, WordPress decided to escape user input to protect against
XSS attacks. Then this happened: https://klikki.fi/adv/wordpress2.html
(Stored XSS via MySQL Column Truncation vulnerability.)

Escaping against XSS attacks should happen on output, not on input. Dead
stop.

You MAY cache the escaped output for performance gains, but keep the
unescaped data in the database in case you need to adjust your escaping
strategy without mangling existing data.

Further reading:
https://paragonie.com/blog/2015/06/preventing-xss-vulnerabilities-in-php-ev=
erything-you-need-know
=E2=80=8B

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com/>=E2=80=8B

--001a113cddec9a381a0535a4ea64--