links.lmorchard.com - #xss

Google Online Security Blog: Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems

Tue, 14 Apr 2009 15:09:21 +0000

Tags: #security #templating #webdev #xss

Filtering & Escaping Cheat Sheet - Pixelated Dreams

Fri, 31 Aug 2007 18:56:07 +0000

Nice cheat sheet, but looking at the semi-random names of all these functions it's no wonder that this stuff isn't just natural.

Tags: #php #security #xss

Chris Shiflett: My Top Two PHP Security Practices

Fri, 31 Aug 2007 18:53:26 +0000

"I have decided to promote my Top Two PHP Security Practices, expressed in four words: Filter input Escape output"

Tags: #php #security #webdev #xss

PHP: Filter Functions - Manual

Tue, 21 Aug 2007 06:40:56 +0000

"This extension serves to validate and filter data coming from some insecure source, such as user input."

Tags: #php #security #xss

Ned Batchelder: Xss with utf-7

Sun, 22 Apr 2007 07:15:00 +0000

"The resulting page doesn't have any explicit declaration of its character set, so depending on your browser settings, the browser may try to auto-detect the character set, and seeing the distinctive UTF-7 byte sequences, will choose UTF-7. In UTF-7, the

Tags: #ugh #utf-7 #webdev #xss

dtm: Most HTML templating languages are written incorrectly

Sun, 15 Apr 2007 22:18:48 +0000

"the problem with virtually every HTML templating language out there is that they make it easier for the person writing HTML templates to add an XSS hole than to avoid it."

Tags: #html #security #templating #webdev #xss