javascript XSS sanitizing if data is already sanitized using PHP

Question

Update:

I'm still confused as ever. Can someone please reply to my last comment?

If all my data (+title1+ and +title2+ in this example -- see below) is sanitized using PHP do I need to worry about javascript as well? I'm concerned about my use of title='"+title2+"' (the apostrophes is my concern) in my code below.

html\javascript:

 <div id="verification"></div>

 <script>


function update() {
    $.ajax({
    url: 'update.php', //php          
    data: "", 
    dataType: 'json',   
    success: function (data) {
        //on receive of reply
        var title1 = data[0];
        var title2 = data[1];          

        $('#verification').html("<img src=images/test"+title1+".gif title='"+title2+"'></img>");     //output to html
        }
    });
}

</script>

json response

["1","test test test"]

output (by Mouseover text with Title)

test test test

php (php sanitizing omitted)

$result = mysql_query("SELECT title1, title2 FROM users WHERE username = '$foobar'")
or die(mysql_error());
$array = mysql_fetch_row($result);
echo json_encode($array);

Need to explain your issue in more detail. Really not clear what you are asking or what problems you are having — charlietfl
– charlietfl, Commented Aug 29, 2015 at 21:49
I asked if I sanitized the data +title1+ +title2+ previously with PHP if my use of title='"+title2+"' (the apostrophes is my concern) is safe — michelle
– michelle, Commented Aug 29, 2015 at 21:50
You should worry more about using deprecated PHP functions mysql_*. — Charlotte Dunois
– Charlotte Dunois, Commented Aug 29, 2015 at 21:56
Could this help you: stackoverflow.com/questions/8318581/… — EugenSunic
– EugenSunic, Commented Aug 29, 2015 at 22:03

Keith · Accepted Answer · 2015-08-31 02:56:35Z

1

There are two different elements that need to be considered:

database: use prepared statements (PDO or mysqli) to avoid SQL injection via user input
UI: escape user input as required to avoid XSS attacks

While the user input has been 'santizied' for queries against the database through the PDO/mysqli prepared statements, further consideration is required before presenting the user input back on the web page in the browser.

edited Aug 31, 2015 at 2:56

answered Aug 31, 2015 at 2:45

Keith

1681 silver badge11 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Keith Over a year ago

... and there are even 2nd Level SQL injection attack vectors.

Collectives™ on Stack Overflow

javascript XSS sanitizing if data is already sanitized using PHP

I'm still confused as ever. Can someone please reply to my last comment?

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

I'm still confused as ever. Can someone please reply to my last comment?

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related