All geek questions in one place

Always avoid being seen? What for?

The Zend Framework Guide reports the following:

60.3.1. Output output

One of the most important tasks to perform in a script view is to make sure that the output is escaped correctly; among other things, it helps to avoid cross-site scripting. If you are not using a function, method, or helper that avoids on its own, you should always avoid variables when outputting them.

Why is it always? Why do I need to avoid variables that have not been created or modified by the user?

+3
source share
7 answers

. , , - " ", . , ? . -, , ..

, , , HTML, XML, JSON - .

+9

, -, , . , , . , , , , .

, $this->escape($variableToEscape) .

+4

- , , , , . .

+2

: HTML-, , .

, , :

foo <b>bar</b>

, HTML-, , , HTML. , ( ), , .

, ,

foo & <b>bar</b>

- ; , :

foo &amp; <b>bar</b>
+1

, - , HTML. "" , . , "" < bob@bob.com > ". , < bob@bob.com > .

+1

, , , XSS. , , , , , , ... , , XSS-, - , (, , - - , - , ), XSS.

.

: MVC , "", . , , , ?

+1

, (, , XML ), .

, / , , , , , , .

0

Source: https://habr.com/ru/post/1712174/

More articles:


All Articles