Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

escape HTML literals to be sure there are no executable script hack attempts

Posted on 2015-01-09
9
Medium Priority
?
196 Views
Last Modified: 2015-01-09
Hi Experts,

Let's say I'm outputting something that I've taken input for  previously.  It's possible that someone tried to place executable javascript in that input field.  I want to write a function that ensures a literal will not execute by escaping out the relevant characters.

Is there a standard way to do this?  What's the best way?

Thanks,
Mike
0
Comment
Question by:thready
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 34

Assisted Solution

by:Big Monty
Big Monty earned 400 total points
ID: 40540799
the easiest way is to escape the < and > chars and use their html expressions.

Eg &lt; instead of < and &gt; instead of > .

var txt = "<script>blah</script>";
var escapedTxt = txt.replace("<", "&lt");
escapedTxt = txt.replace(">", "&gt");
0
 
LVL 9

Assisted Solution

by:sudheeshthegreat
sudheeshthegreat earned 400 total points
ID: 40540886
Some of the JS frameworks like jQuery, Prototype and Underscore have such functions to HTML-encode a string.
0
 
LVL 53

Accepted Solution

by:
COBOLdinosaur earned 800 total points
ID: 40541098
The prevention of code injection should be part of the routine sanitization server side.  If you are using PHP you have al the method necessary to cleanup anything.  If the data is being stored in a database then using PDO objects forces security before you can insert the data to a DB table.  

Trying to prevent code injection with scripting on the client side is inviting hacks. Idon't care how good you are; the hackers will still beat you if you rely on client side solutions.  There ar just to may ways to fool a browser, because its job is to make things work even with errors, while on the server side the priority is on accessing and protecting resources.

Cd&
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 84

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 400 total points
ID: 40541165
In general, you need to accept only 'good' input and reject all other input.  That requires you to define what is good input.  And Cd& is correct.  Client side filtering should be to help the client fill out the form correctly.  Server side filtering is to protect the server and the database.  All of my form pages use both.
0
 
LVL 53

Expert Comment

by:COBOLdinosaur
ID: 40541205
A lot of the client side helper stuff can be implemented automatically in HTML5, all we need now is to wait for the older browser to phase out and we can get rid of almost all the form related scripting.

Cd&
0
 
LVL 1

Author Closing Comment

by:thready
ID: 40541212
Thanks everyone!
0
 
LVL 84

Expert Comment

by:Dave Baldwin
ID: 40541225
You're welcome.  On several sites, I've had to kill the HTML5 crap because it did it wrong for what was needed.  'automatically' usually means that you have fixed all the problems and now it works 'automatically'.
0
 
LVL 53

Expert Comment

by:COBOLdinosaur
ID: 40541252
LOL... when was the last time anything was delivered by any major software vendor without bugs?

Cd&
0
 
LVL 84

Expert Comment

by:Dave Baldwin
ID: 40541329
Oh... yesterday between 4:03 and 4:04 AM...  Never.  And the biggest bug of all has always been 'them' believing without any evidence that they knew what was needed.  As has been said... the nice thing about standards is that there are so many of them to choose from.
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Q&A with Course Creator, Mark Lassoff, on the importance of HTML5 in the career of a modern-day developer.
Originally, this post was published on Monitis Blog, you can check it here . In business circles, we sometimes hear that today is the “age of the customer.” And so it is. Thanks to the enormous advances over the past few years in consumer techno…
The viewer will the learn the benefit of plain text editors and code an HTML5 based template for use in further tutorials.
HTML5 has deprecated a few of the older ways of showing media as well as offering up a new way to create games and animations. Audio, video, and canvas are just a few of the adjustments made between XHTML and HTML5. As we learned in our last micr…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question