[Misc] PHP's filter extension and HTML Purifier

Hello,

I have an other question. Can we used filter functions like filter_input, to prevenr a XSS attack ?

Or it's useless, to use filter_input for check and validate input date form external source?

Thanks for your answer.

Alexandre Joly.

Edited 1 time(s). Last edit at 04/02/2007 06:31AM by Ambush Commander.

It depends on what you want to do. PHP's filter extension does not have HTML filtering built-in, so you'll have to use HTML Purifier for that job. For simpler datatypes, though, like integers, floating point numbers, email addresses, etc, filter's validation functions should be good enough for guarding against XSS.

Some people who believe in defense-in-depth would say that you should still htmlspecialchars() anything on the way out. Might not be a bad idea.

HTML Purifier, Standards Compliant HTML Filtering

Ok good, i think i continue to use HTML Purifier but i think i'll used filter for email adresses, i think it's better than REGEX.

Thanks for your answers.

Alexandre Joly.

filter actually implements its email checking functionality with regexps. The trick is finding the right one! :-) Good call though: HTML Purifier can only validate HTML.

HTML Purifier, Standards Compliant HTML Filtering