| Andreas |
08-07-2007 02:41 PM |
Quote:
I assume that once the data is there, it can be trusted.
|
Wrong assumption.
Example: A post that contains
Quote:
<script type="text/javascript">
alert('XSS!');
</script>
|
Now, if you parse this text or run htmlspecialchars_uni() on it you are safe.
However, if you just read pagetext from table post and output it, then you just created an XSS issue.
Quote:
Originally Posted by vBulletin functions.php
PHP Code:
/**
* Returns an UPDATE or INSERT query string for use in big queries with loads of fields...
*
* @param array Array of fieldname = value pairs - array('userid' => 21, 'username' => 'John Doe')
* @param string Name of the table into which the data should be saved
* @param string SQL condition to add to the query string
* @param array Array of field names that should be ignored from the $queryvalues array
*
* @return string
*/
|
As you can see, it runs escape_string() automatically |
More Information