Prevent XSS Attacks. Escape Strings in PHP
Here's the special discount link for Rob's course:
http://www.johnmorrisonline.com/coupo...
Get the source code in the Code Snippets section here:
http://www.johnmorrisonline.com/web-d...
Training Center:
http://www.johnmorrisonline.com/training
Subscribe on YouTube:
/ johnmorrisonline
Subscribe on SoundCloud:
/ johnmorrisonline
Subscribe on iTunes:
http://goo.gl/RggnXW
What Is XSS?
XSS stands for cross-site scripting and it refers to a type of attack where a hacker injects malicious client-side code into the output of your page.
Applications that don't escape their output are vulnerable to this type of attack.
XSS Example
A simple example is a blog comment. If not properly escaped, an attacker could enter (for example) JavaScript code into the blog comment.
That code would be stored in the database, output to the page when loaded, and because it's not escaped... render and run.
Thus, the attacker would have the full range of JavaScript capabilities to attack you and your site visitors.
How to Prevent XSS Attacks
As illustrated in the video above, you prevent XSS attacks by escaping your output using htmlspecialchars() or htmlentities().
Both PHP functions convert problematic characters into HTML entities causing the injected code to be output harmlessly and not rendered.
htmlentities vs htmlspecialchars
Both will prevent XSS attacks. The difference is in the characters each encodes. htmlentities will encode ANY character that has an HTML entity equivalent.
htmlspecialchars ONLY encodes a small set of the most problematic characters.
It's generally recommended to us htmlspecialchars because htmlentities can cause display problems with your text depending on characters are being output.
Think of htmlspecialchars as a scalpel and htmlentities as a hammer. Both can solve the problem... one is just a little more precise.
~-~~-~~~-~~-~
Please watch: "Ryan Carson: How to Get an IT Job WITHOUT a College Degree"
• Ryan Carson: How to Get an IT Job WIT...
~-~~-~~~-~~-~
#php #webdev
Смотрите видео Prevent XSS Attacks. Escape Strings in PHP онлайн без регистрации, длительностью часов минут секунд в хорошем качестве. Это видео добавил пользователь John Morris 18 Июнь 2015, не забудьте поделиться им ссылкой с друзьями и знакомыми, на нашем сайте его посмотрели 37,795 раз и оно понравилось 305 людям.