Why is HTML in forums so dangerous?

[twobob]

Hi Guys

So the security issue is about someone with HTML posting access, posting something nasty - not about viewing HTML from someone trusted?

(Ie - if I'm the only one to post in HTML, then are there any security issues to worry about?)

Also, if I have some HTML (eg IFRAME) within the post, why won't it print? (ie - I see my HTML image within my post, but not when I try to print it!).

Thanks for your help

twobob

[sydude]

Originally Posted by SirAdrian

People can steal your cookie information, then load it into their browser and be logged in as you. They can also post harmful content (movies, images, etc). If they were to post <base> tags or iframes, they can muck up all your links or load other sites in your pages.

Javascript is probably the biggest concern, but there many other annoyances.

Stealing the cookie information and logging in as another user (especially an admin) is the only item that really scares me, I'm not concerned about the others. How difficult is it for someone to do that? I don't need details (I don't want anyone that doesn't already know how to do it to learn), but I'd like to know if this is something that can be done by anyone with decent computer skills, or if it's something that is possible only by an NSA level hacker. I'm not concerned with the latter.

[Dr.Viggy]

thanks for the info everyone. i had been wondering the same thing.

[kafi]

Do I understand this issue correctly if I think:

- that threat comes only from users that will input html in the post causing the harm

OR

- certain broken html can become a hole that can be used (missued) by SPAMers for such purposes (in this case also trusted usegroup can do harm...??? if their html is open, broken etc.)

[UncoderMom]

I thought VB fixed the cookie theft issue in php?