Building Browsergames - Latest Comments in Cross Site Scripting: what it is, and how to prevent it

Re: Cross Site Scripting: what it is, and how to prevent it

bbgames — Mon, 29 Dec 2008 13:56:31 -0000

Roy,
You could definitely do both - how much you allow or disallow is entirely up
to you.

Re: Cross Site Scripting: what it is, and how to prevent it

Roy — Sun, 28 Dec 2008 10:46:45 -0000

So why not simply do both? Make Account names viable if they are only Numbers and letters( ex A-Z, a-z, 0-9), no other char allowed, as well as escaping the repeating information?

Re: Cross Site Scripting: what it is, and how to prevent it

bbgames — Thu, 06 Nov 2008 20:36:43 -0000

While it would make sense to escape the username before it enters the
database, escaping it afterwards helps protect you against XSS attacks that
originate *from* your database - for example, if an attacker gained access
to your database and hand-entered the data.
Rejecting usernames that have special characters in them isn't a bad idea,
but it tends to confuse the user - which characters are invalid? Which
aren't? It would be more useful if you could tell them which characters were
not allowed.

Re: Cross Site Scripting: what it is, and how to prevent it

Abraxas — Thu, 06 Nov 2008 00:39:04 -0000

I agree that as a general rule this is excellent practice but for something like the user name wouldn't it make for sense to escape it before adding it to the database instead of every time it is displayed? In fact as part of my registration validation I compare the user name with the return from the escape function and if they're not equal I reject the name:

if ($username != htmlspecialchars($username)) {
$err = "name contains invalid characters";
}