针对XSS的安全数据库条目

Question

I'm creating an app that retrieves the text within a tweet, store it in the database and then display it on the browser. The problem is that I'm thinking if the text has PHP tags or HTML tags it might be a security breach there.

I looked into strip_tags() but saw some bad reviews. I also saw suggestions to HTML Purifier but it was last updated years ago.

So my question is how can I be 100% secure that if the tweet text is "<script> something_bad() </script>" it won't matter?

To state the obvious the tweets are sent to the database from users so I don't want to check all individually before displaying them.

Answer 1

You need to convert the HTML characters <, > (mainly) into their HTML equivalents <, >.

This will make a < and > be displayed in the browser, but not executed - ie: if you look at the source an example may be <script>alert('xss')</script>.

Before you input your data into your database - or on output - use htmlentities().

Further reading: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet