Thread: SDE - exploit?
View Single Post
Old 02-08-2003, 06:21 PM   #2 (permalink)
sde
Moderator
 
sde's Avatar
 
Join Date: May 2002
Location: us.ca
Posts: 4,505
sde is on a distinguished road
sorry man, that was a post gone way bad =)

i noticed that html is enabled in your forums.. so i was trying to be a smartass and put a meta-redirect and make it redirect to code newbie when someone viewed my post ...

however, .. something stopped part of the html from showing.. i believe it was the quotes in my post.

you should use the html entities function so people can't use any html in your forums. it is a big security risk.

for example:
PHP Code:
<?
$post
="< html >";

$post=htmlentities($post);

echo 
$post;
?>
after $post goes through the htmlentiteis filter, .. it will be this:

&lt; html &gt;

that is so it will display proplerly in the forums, and also it will prevent any html from executing too.

does that make sense?

sorry i messed the forums up .. after posting the first one, it didn't show right away. i'm not sure why there is a gap from when you post to when it shows up... so that is why i posted the second one... i thought i experienced the bug you had problems with before .. posts not showing up for some reason .. but then after i posted the second one.. both of them were there . =/
sde is offline   Reply With Quote