<\/script>')
Have Geek Brain

Is it good to have HTML tags inside an array (there is a risk of a hack)?

I have the following array:

'tagline_p' => "I'm a <a href='#showcase'>multilingual web</a> developer, designer and translator. I'm here to <a href='#contact'>help you</a> reach a worldwide audience.",

Should I avoid HTML tags inside an array to avoid hacks on my site? (How to avoid them?)

or is it ok to have HTML tags inside an array?

+2


a source to share


6 answers


The only time it becomes a problem is when it contains user input. You know what you are putting into your array and you trust it. But you don't know what the users are going through and don't trust it.

Therefore, in this particular case, shielding is not required. But once the user input is involved, you must avoid the input.

It is not the HTML itself, which is dangerous, but the type of HTML users can go through, for example, script tags that allow them to execute Javascript.



Adding

Note that it is best to only exit at the exit not at the entrance. The result is where data can do damage, so you want to consistently avoid this. This way, you don't have to make sure that all input is escaped.

Thus, you have no problem when outputting data in different formats, where different rules may apply. You don't need to use things like stripslashes()

or htmlspecialchars_decode()

if you don't need things to be output as html.

+8


a source


It is good to store data in an array.

You need to avoid tags when you output it to the HTML context and you don't trust it or you don't want the HTML to be interpreted.



You need to avoid data according to where you send it; for HTML, if you don't want to be read as HTML you can use htmlspecialchars (), similarly if you put it in a SQL statement and you don't want to be read as SQL, you can use mysql_real_escape_string () etc. ...

+1


a source


You should avoid HTML when it was entered by the user (and therefore not secure) AND you are going to display that HTML on your site. If you wrote it, it doesn't require any exit.

If you need to get out of the html, you must do so right before it is displayed on your site. There is no need to escape the data when you are just dragging it in (as you are apparently doing with this array). You can avoid HTML with htmlspecialchars () function .

+1


a source


(Use htmlspecialchars

or htmlentities

to avoid HTML.)

Having HTML tags is okay if you restrict the set of tags and attributes from the user, as long as this array is dynamically generated. For example, <script>

shouldn't be allowed or event handlers for example onmouseover

.

0


a source


It depends on how the HTML gets into the array. If this is hardcoded by you, it might be okay. If it's coming from the user, well, any user input is suspicious - the HTML is just harder to clean up.

The real question might be "Why do you want to put HTML in an array?" If it's static text, place it in a template file somewhere.

0


a source


create an array of valid tags and use strip_tags($input_array[$key],$allowable_tags)

or make a function like this

function sanitize_input($allowable_tags='<br><b><strong><p>')
{                   
    $input_array = $input;
    foreach ($input as $key=>$value){
   if(!empty($value)) {
    $input_array[$key] = strip_tags($input_array[$key],$allowable_tags);
   }
 }
 return $input_array;

}
0


a source






More articles:


All Articles