vb.org Archive - Secure output of custom bbcode

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - Secure output of custom bbcode (https://vborg.vbsupport.ru/showthread.php?t=315975)

kaldorei14

12-12-2014 08:39 AM

Secure output of custom bbcode

I created a plugin using hook location bbcode_create, bbcode_fetch_tags and a .php file to handle a custom bbcode. What should I do to secure the output? For example, do I need to call xss_clean() or filter htmlspecialchars?

Dave	12-12-2014 08:48 AM

Check the do_clean function in includes/class_core.php.

If you defined the type as TYPE_NOHTML, it will do:

PHP Code:


		
			
htmlspecialchars_uni(trim(strval($data)))

Call it like do_clean($variable, TYPE_NOHTML);

kaldorei14

12-12-2014 07:02 PM

Thanks, I'll try it.

All times are GMT. The time now is 04:58 AM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.00975 seconds Memory Usage 1,708KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (3)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: