How does using htmlspecialchars on an INT make it more secure?
#1
Home away from home
Home away from home


See User information
While developing a module for version 2.18 I have come across a loading of coding that to be quite frank, is not required or is totally overboard. One such class is xoopsFormRadio and the new method of securing this class.

While the first fact is that it no longer works,

Example you have to change:

Quote:
if ( $value === $ele_value ) {


To:

Quote:
if ( $value == $ele_value ) {


As under the newer method it will never truly equal.

But my main problem with the changes is that you are not treating the variables in the correct manner, or I am really failing to see what real benefits are from the changes made.

Example:

$ret .= ".$ele_name."' value='".htmlspecialchars($valueENT_QUOTES)."'";


$value is and should be treated like an INT. Here we are treating that variable in the same manner as we would treat a text value.

In this case it should have been:

$ret .= ".$ele_name."' value='".intVar($value)."'";


Actually with the case in mention, it would have been better to treat these values as boolean instead.

Posted on: 2007/12/18 6:40
 Top  Twitter  Facebook    Linkedin  Del.icio.us  Digg  Reddit  Mr. Wong 


Re: How does using htmlspecialchars on an INT make it more secure?
#2
Friend of XOOPS
Friend of XOOPS


See User information
Hello John,

I have some scripts where the value "returned" by the option is not an integer but a string.
I believe that's the reason of this no ?

Finally, I also believe that when a value is returned from a form's field and when this value is surrounded by quotes, it is considered (and converted) as a string by Php (it may depends of your Php version).

Bye,
Hervé

Posted on: 2007/12/18 9:11
 Top  Twitter  Facebook    Linkedin  Del.icio.us  Digg  Reddit  Mr. Wong 







You can view topic.
You cannot start a new topic.
You cannot reply to posts.
You cannot edit your posts.
You cannot delete your posts.
You cannot add new polls.
You can vote in polls.
You cannot attach files to posts.
You cannot post without approval.
You cannot use topic type.
You cannot use HTML syntax.
You cannot use signature.
You cannot create PDF files.
You cannot get print page.

[Advanced Search]


Login
Username:

Password:

Remember me



Lost Password?

Register now!
Search
Recent Posts
Who's Online
129 user(s) are online (96 user(s) are browsing Support Forums)

Members: 0
Guests: 129

more...
Donat-O-Meter
Make donations with PayPal!
Stats
Goal: AU$15.00
Due Date: Jul 31
Gross Amount: AU$0.00
Net Balance: AU$0.00
Left to go: AU$15.00
Latest GitHub Commits
Recent forum posts
Recent Comments
About us
Learn
Use
Develop GitHub
Contribute
Connect
Terms of Use | Privacy Policy | Hosted by Arvixe Hosting | RSS 2.0 Button