Chris Shiflett has a post today, Allowing HTML and Preventing XSS. The problem is how to allow users to format their contributed content without introducing security vulnerabilities. The answer is usually some sort of markup language or filtering and sanitization of HTML.
BBCODE was designed for this purpose. There is no actual standard, [...]
The Problem with Markup Languages
March 14th, 2007Two preg_replace Escaping Gotchas
November 13th, 2005preg_replace is a workhorse PHP function, but it has a couple of escaping gotchas that can cause it to yield unexpected or undesirable results.
Feed
Subscribe to this blog…