On Sun, 15 Feb 2004, Jan Lehnardt wrote:
> On 8 Feb 2004, at 21:26, Rasmus Lerdorf wrote:
> > Perhaps the real answer here is to turn on input filtering by default
> > so
> > we defeat XSS once and for all across the board.
>
> seems like nobody is interested. I'd like to see some sort
> of discussion on this. How would an actual implementation
> would or should look like in PHP 5? What are the benefits
> (obvious, but still), what are the drawbacks (partly obvious,
> but still)? Is it PHP's role to provide this kind of
> XSS prevention built-in or is it sufficient to give the
> possibility to add it by hand (like now)? What is
> internals' opinion on this?
I don't think there is any question that PHP should play a role in helping
people solve XSS which is why I added it to PHP5. However, as it is, the
average person is not going to use it since it requires implementing the
security policy in C.
Implementation-wise we could go all out and break everything. Add a
striptags-like filter to be applied to all remote input data and have an
access function that lets you get the raw data. So something like:
input data POST data foo : Hi <b>jan@php.net</b>
what you see in $_POST['foo'] : Hi jan@php.net
get_raw_data(POST, 'foo') : Hi <b>jan@php.net</b>
get_raw_data(POST, 'foo', MAIL_FILTER): jan@php.net
with various other filters possible along with user-supplied ones.
-Rasmus
