Security Thread, Get/Post your tips here!

[litewarez]

XSS Filtering is not easy to get perfect but you can prevent alot of attacks by attempting to convert the source value (search,comment) into its entities.

Usually when i build a system i will sanitize all input as stranded !

For instance

function sanitize($input)
{
    if(is_array($input))
    {
        $temp = array();
        foreach($input as $k => $v)
        {
             $temp[$k] = sanitize($v);
        }
        return $temp;
    }
    return htmlentities($input,ENT_QOUTES);
}

$_GET = sanitize($_GET);
$_POST = sanitize($_POST);

$search = $_GET['search']; 

If a user posts in your search box something like "<div />" the value of $search about will be "&lt;div /&gt;".

so if you use $search in your template / html file its pretty safe.

Also take note of Strip Tags and Filter Var in PHP

[desiboy]

litewarez thanks for the code.

I just found this
http://htmlpurifier.org/

[litewarez]

i ment to mention that to you but i forgot to add it to the topic..

that peice of kit is really really good and cuts out a loads of possibilities but its very bulky for its single purpose.

[NewEraCracker]

And what about null bytes?

http://php.net/manual/en/security.filesystem.nullbytes.php

and btw I null scripts my own when I can. If I can't or don't have time, then I use DGT or FS nulls.

[Loget]

Thread unstuck, mainly due to inactivity and the fact that litewarez himself stickied this thread when he was moderator.

[dermechove]

I just wanted to talk about the PL1 fix for vbulletin 3.8.6
you have to save this code in a file and upload it to your server(login as admin maybe required since I was logged in as amin when I tested it )

<?php
require_once('global.php'); 
$db->query_write("DELETE from " . TABLE_PREFIX . "phrase WHERE varname = 'database_ingo'"); 
echo "successfully patched";
?>

and then just navigate to it using your browser
that was the PL1 fix.
@NewEraCracker
for null byte vuln you can use addslashes

[NewEraCracker]

Thanks for the info

[desiboy]

small sanitizing function

    function sanitize($str)
    {
        return strtolower(strip_tags(trim(($str))));
    }