Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94148
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.163 cause and error)
MIME-Version: 1.0
In-Reply-To: <5767B388.8060807@lsces.co.uk>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
 <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
 <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
 <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
 <CAEDdnaUi5hvOAkkPWWk3YVNxMjsCbntB-W70a8sPXFkKHJGY8w@mail.gmail.com>
 <5766FA91.60803@lsces.co.uk> <CANUQDCis9TVyR6fNbDOfCWF1fJeqU0M+Gby-_C47pEXZocBang@mail.gmail.com>
 <5767B388.8060807@lsces.co.uk>
Date: Mon, 20 Jun 2016 12:51:55 +0200
Message-ID: <CANUQDCgyhiBXPKkA5MEu5D7NCjuuaVfodC_SQnf+YOnW6YdeEA@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114687ea35b3830535b37efc
Subject: Re: [PHP-DEV] New escaped output operator
From: me@kelunik.com (Niklas Keller)

--001a114687ea35b3830535b37efc
Content-Type: text/plain; charset=UTF-8

2016-06-20 11:12 GMT+02:00 Lester Caine <lester@lsces.co.uk>:

> On 20/06/16 07:00, Niklas Keller wrote:
> >> Now ... I want to add content that includes
> >> > <script>alert("xss")</script> it needs to be in the format
> >> > &lt;script&gt;alert(&quot;xss&quot;)&lt;script&gt; so that it never
> >> > appears in the 'dangerous' format, but if $user['about_me'] is
> >> > designated a simple text string, then any attempt to add
> >> > <script>alert("xss")</script> via an input should be blocked!
> >
> > No, it shouldn't be blocked. It should just be escaped on output. What if
> > that's a comment to a tech blog, where we talk about these things instead
> > of trying to find a vulnerability?
>
> Re-read what I wrote!
>

I read it and I fundamentally disagree with that.


> You should ALWAYS sanitise simple text such as short descriptions, and
> even user names and other simple text fields and I would always do that
> with strings like $user['about_me'] ...



> '<?~' creates a false sense of
> security


You're right. But it's the case because it doesn't obey the output context.
It's not because it escapes on outpu


> when users should be educated as to the risks that NOT
> validating data can create. Such as overflowing field sizes and creating
> text which internally can cause problem even before outputting to a
> browser


Data validation is a totally different topic and not what this thread is
about.


> such as quotes in combined strings.
>

Where's that an issue?


> ( Rowan sums up the output side nicely ... )
>
>

--001a114687ea35b3830535b37efc--