homepage security

[filburt1]

Originally Posted by sabret00the

in calling the homepage as $userinfo[homepage] is their any security risks if i just have

<a href="$userinfo[homepage]">$userinfo[homepage]</a>

I believe that quotes are stripped from the URL so it should be fine. As a test, change your profile home page to (including the quotes):

" onMouseOver="alert('foo')

Then move your mouse over the resulting link and see if you get a Javascript alert.

edit: Also try this important test:

javascript:alert('foo')

...and click the link and see what happens.