Best way to avoid javascript's executing

Question

I'm using PHP and Zend Framework in my application. User can enter some HTML and admin can see this HTML. I want to avoid XSS injection. All HTML should me shown as is except any javascript. I tried to remove script tags but it is unsafe. User can add javascript to onclick or other events.

Thanks.

in this case i'd probably use some kind of an input cleaner/purifier. For example htmLawed: bioinformatics.org/phplabware/internal_utilities/htmLawed/… — Kane Cohen
– Kane Cohen, Commented Mar 30, 2012 at 12:23

Nick · Accepted Answer · 2012-03-30 12:26:59Z

4

If you are looking to sanitize user input like this from XSS, I'd look into using HTML purifier

Removing only script tags is not enough, you miss out any javascript inline that people can add, among other things.

HTML purifier however will remove it all for you. From their site:

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications.

answered Mar 30, 2012 at 12:26

Nick

6,3462 gold badges32 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Alex Pliutau Over a year ago

Nice tool. Thanks. I will investigate it.

Bram · Accepted Answer · 2012-03-30 12:25:41Z

1

I think your best bet would be to manually cover all vulnerabilities.

Start by removing script tags, then run regular expressions on the on events (onclick, onhover...) and remove those as well. There's more offcourse...

CodeIgniter (other frameworks as well probably) has a function xss_clean(), you might have a look at that one to see what they do.

answered Mar 30, 2012 at 12:25

Bram

1,1121 gold badge9 silver badges25 bronze badges

Collectives™ on Stack Overflow

Best way to avoid javascript's executing

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related