Download Zend Enterprise PHP Patterns

C H A P T E R 6 N S E C U R I N G Y O U R P H P A P P LI C A T I O N S
eb$ r]h:.11%++Jkj)=O?EE
w
napqnj"w i]p_daoW-Yy77
y
eb$$ r]h:921"" r]h895,%xx++=)V
$ r]h:953"" r]h89-..%xx++])v
$ r]h:904"" r]h8913%%++,)5
w
napqnj_dn$ r]h%7
y
napqnj i]p_daoW,Y7
y
ejlqp9dpihola_e]h_d]no$"3.7"407"337"327%7
kqplqp9lnac[nalh]_a[_]hh^]_g$#"]il7$$;6W,)5Y'%x$;6t$;6W,)5=)BY'%%%7;e#(£
#`a_k`a#( ejlqp%7
lnejp kqplqp7
;:
Along with handling our example user input of "3.7"407"337"327 cleanly,
Listing 6-9 also handles ",t047",t107",t0@7",t0?7ˆTHESAMEh(4-,vENCODEDSTRING
value except using hexadecimal values instead of decimals when representing each character (yet another encoding circumstance to be aware of). Not quite as simple as just
calling the dpihola_e]h_d]no$% function but not too cumbersome either once the problem
is correctly understood. It is important to note that these solutions are quite useful when
the goal is to prevent an attacker’s malicious input from compromising the integrity of
your output to a degree that allows the execution of unauthorized JavaScript through
property encoding of data, but at what cost?
Allowing User-Provided Markup
There are many times in the development of certain types of web applications (forum
systems come to mind) where it is desirable to allow user input to contain some degree of
markup such as a harmless set of 8^:8+^: tags. For situations where this is the case, how
do we filter and validate the input?
The short answer, unfortunately, is basically you can’t.
Download at WoWeBook.Com
137