Solved

escape HTML literals to be sure there are no executable script hack attempts

Posted on 2015-01-09
9
184 Views
Last Modified: 2015-01-09
Hi Experts,

Let's say I'm outputting something that I've taken input for  previously.  It's possible that someone tried to place executable javascript in that input field.  I want to write a function that ensures a literal will not execute by escaping out the relevant characters.

Is there a standard way to do this?  What's the best way?

Thanks,
Mike
0
Comment
Question by:thready
9 Comments
 
LVL 32

Assisted Solution

by:Big Monty
Big Monty earned 100 total points
ID: 40540799
the easiest way is to escape the < and > chars and use their html expressions.

Eg &lt; instead of < and &gt; instead of > .

var txt = "<script>blah</script>";
var escapedTxt = txt.replace("<", "&lt");
escapedTxt = txt.replace(">", "&gt");
0
 
LVL 9

Assisted Solution

by:sudheeshthegreat
sudheeshthegreat earned 100 total points
ID: 40540886
Some of the JS frameworks like jQuery, Prototype and Underscore have such functions to HTML-encode a string.
0
 
LVL 53

Accepted Solution

by:
COBOLdinosaur earned 200 total points
ID: 40541098
The prevention of code injection should be part of the routine sanitization server side.  If you are using PHP you have al the method necessary to cleanup anything.  If the data is being stored in a database then using PDO objects forces security before you can insert the data to a DB table.  

Trying to prevent code injection with scripting on the client side is inviting hacks. Idon't care how good you are; the hackers will still beat you if you rely on client side solutions.  There ar just to may ways to fool a browser, because its job is to make things work even with errors, while on the server side the priority is on accessing and protecting resources.

Cd&
0
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 100 total points
ID: 40541165
In general, you need to accept only 'good' input and reject all other input.  That requires you to define what is good input.  And Cd& is correct.  Client side filtering should be to help the client fill out the form correctly.  Server side filtering is to protect the server and the database.  All of my form pages use both.
0
DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

 
LVL 53

Expert Comment

by:COBOLdinosaur
ID: 40541205
A lot of the client side helper stuff can be implemented automatically in HTML5, all we need now is to wait for the older browser to phase out and we can get rid of almost all the form related scripting.

Cd&
0
 
LVL 1

Author Closing Comment

by:thready
ID: 40541212
Thanks everyone!
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 40541225
You're welcome.  On several sites, I've had to kill the HTML5 crap because it did it wrong for what was needed.  'automatically' usually means that you have fixed all the problems and now it works 'automatically'.
0
 
LVL 53

Expert Comment

by:COBOLdinosaur
ID: 40541252
LOL... when was the last time anything was delivered by any major software vendor without bugs?

Cd&
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 40541329
Oh... yesterday between 4:03 and 4:04 AM...  Never.  And the biggest bug of all has always been 'them' believing without any evidence that they knew what was needed.  As has been said... the nice thing about standards is that there are so many of them to choose from.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
This article discusses how to create an extensible mechanism for linked drop downs.
In this tutorial viewers will learn how to position overlapping items using z-index in CSS. They will also learn the restrictions on the z-index property.  Create a new HTML document with an internal stylesheet.: Create a div in CSS and name it Red.…
In this tutorial viewers will learn how to style elements, such a divs, with a "drop shadow" effect using the CSS box-shadow property Start with a normal styled element, such as a div.: In the element's style, type the box shadow property: "box-shad…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now