I have my function here to clean strings called  function clean($str) {   $str = htmlspecialchars(strip_tags(trim(mb_convert_encoding($str, 'UTF-8', 'UTF-8'))), ENT_QUOTES, 'UTF-8'); return $str; }   Right now, I checked the possible XSS attacks, And this one worked ok on &lt;img src"$str"&gt; but when i swapped the the element to &lt;iframe src"$str"&gt; the JS was executed using the following  $attr = clean("javascript:alert(\"RSnake says, 'XSS'\")"); $str = "&lt;iframe src=\"$attr\"&gt;";   But for $str = "&lt;img src=\"$attr\"&gt;"; it was safe.  How to handle this vulnerability?  What i did was adding extra part for the function which was like this  function clean($str) {   $str = htmlspecialchars(strip_tags(trim(mb_convert_encoding($str, 'UTF-8', 'UTF-8'))), ENT_QUOTES, 'UTF-8'); $str = htmlentities($str, ENT_QUOTES); return $str; }
123007
We have a high security application and we want to allow users to enter URLs that other users will see.  This introduces a high risk of XSS hacks - a user could potentially enter javascript that another user ends up executing. Since we hold sensitive data it's essential that this never happens.  What are the best practices in dealing with this? Is any security whitelist or escape pattern alone good enough?   Any advice on dealing with redirections ("this link goes outside our site" message on a warning page before following the link, for instance)  Is there an argument for not supporting user entered links at all?    Clarification:  Basically our users want to input:      stackoverflow.com   And have it output to another user:  &lt;a href="http://stackoverflow.com"&gt;stackoverflow.com&lt;/a&gt;   What I really worry about is them using this in a XSS hack. I.e. they input:     alert('hacked!');   So other users get this link:  &lt;a href="javascript:alert('hacked!');"&gt;stackoverflow.com&lt;/a&gt;   My example is just to explain the risk - I'm well aware that javascript and URLs are different things, but by letting them input the latter they may be able to execute the former.  You'd be amazed how many sites you can break with this trick - HTML is even worse. If they know to deal with links do they also know to sanitise &lt;iframe&gt;, &lt;img&gt; and clever CSS references?  I'm working in a high security environment - a single XSS hack could result in very high losses for us. I'm happy that I could produce a Regex (or use one of the excellent suggestions so far) that could exclude everything that I could think of, but would that be enough?
36722
I have a long string (a DNA sequence). It does not contain any whitespace character.  For example:  ACTGATCGAGCTGAAGCGCAGTGCGATGCTTCGATGATGCTGACGATGCTACGATGCGAGCATCTACGATCAGTCGATGTAGCTAGTAGCATGTAGTGA   What would be the CSS selector to force this text to be wrapped in a html:textarea or in a xul:textbox?
16453
Friends, sometimes I had to create a self-contained PHP script. That means the PHP script could have any files within it due to some encoding/decoding algorithm, like Base64. For example,  is a Base64 encoding of this tiny image:   Of course, in this particular case, PHP can handle that huge encoded string because it has a bundled  function.  I was wondering if this idea is possible to achieve somehow in TeX/LaTeX. I need to point out that I'm just curious on this subject, not that I want to embed whatever in code. Besides, as you noted, the encoded string is huge, so that'd surely make people cry blood.  One possible solution I see is if somebody implement an encoding/decoding algorithm in TeX/LaTeX, like \base64_decode, so it would be possible to use something like this: \includegraphics{\base64_decode{\myhugeunreadablestring}}. Sorry for the acid trip ticket, but I'm really curious on how this insane code would work. =)
61185
I'm trying to remove some characters from file(UTF-8). I'm using tr for this purpose:   tr -cs '[[:alpha:][:space:]]' ' ' &lt;testdata.dat    File contains some foreign characters (like "Латвийская" or "àé"). tr doesn't seem to understand them: it treats them as non-alpha and removes too.  I've tried changing some of my locale settings:  LC_CTYPE=C LC_COLLATE=C tr -cs '[[:alpha:][:space:]]' ' ' &lt;testdata.dat LC_CTYPE=ru_RU.UTF-8 LC_COLLATE=C tr -cs '[[:alpha:][:space:]]' ' ' &lt;testdata.dat LC_CTYPE=ru_RU.UTF-8 LC_COLLATE=ru_RU.UTF-8 tr -cs '[[:alpha:][:space:]]' ' ' &lt;testdata.dat   Unfortunately, none of these worked.  How can I make tr understand Unicode?
32799
I got feedback from security guy and he pointed out that I should use proper escaping of user input in my code. So I've done some research and found escaping functions.  What’s the difference between them? When should I use esc_html() and when esc_attr()? And when should I use these functions with _e() at the end?
859
For a poor man's implementation of near-collation-correct sorting on the client side I need a JavaScript function that does efficient single character replacement in a string. Here is what I mean (note that this applies to German text, other languages sort differently):  native sorting gets it wrong: a b c o u z ä ö ü collation-correct would be:   a ä b c o ö u ü z  Basically, I need all occurrences of &quot;ä&quot; of a given string replaced with &quot;a&quot; (and so on). This way the result of native sorting would be very close to what a user would expect (or what a database would return). Other languages have facilities to do just that: , in , , . But what about JavaScript? Here is what I have right now. // s would be a rather short string (something like  // 200 characters at max, most of the time much less) function makeSortString(s) {   var translate = {     &quot;ä&quot;: &quot;a&quot;, &quot;ö&quot;: &quot;o&quot;, &quot;ü&quot;: &quot;u&quot;,     &quot;Ä&quot;: &quot;A&quot;, &quot;Ö&quot;: &quot;O&quot;, &quot;Ü&quot;: &quot;U&quot;   // probably more to come   };   var translate_re = /[öäüÖÄÜ]/g;   return ( s.replace(translate_re, function(match) {      return translate[match];    }) ); }  For starters, I don't like the fact that the regex is rebuilt every time I call the function. I guess a closure can help in this regard, but I don't seem to get the hang of it for some reason. Can someone think of something more efficient?  Answers below fall in two categories:  String replacement functions of varying degrees of completeness and efficiency (what I was originally asking about) A  of  , which is now  among JS engines (not so much at the time of the question) and could solve this category of problem much more elegantly.
89886
According to the , in order to make code more portable, they recommend using something like the following for escaping data:  if (!get_magic_quotes_gpc()) {     $lastname = addslashes($_POST['lastname']); } else {     $lastname = $_POST['lastname']; }   I have other validation checks that I will be performing, but how secure is the above strictly in terms of escaping data? I also saw that magic quotes will be deprecated in PHP 6. How will that affect the above code? I would prefer not to have to rely on a database-specific escaping function like mysql_real_escape_string().
115340
Is it possible to "wipe" strings in Delphi? Let me explain:  I am writing an application that will include a DLL to authorise users. It will read an encrypted file into an XML DOM, use the information there, and then release the DOM.  It is obvious that the unencrypted XML is still sitting in the memory of the DLL, and therefore vulnerable to examination. Now, I'm not going to go overboard in protecting this - the user could create another DLL - but I'd like to take a basic step to preventing user names from sitting in memory for ages. However, I don't think I can easily wipe the memory anyway because of references. If I traverse my DOM (which is a TNativeXML class) and find every string instance and then make it into something like "aaaaa", then will it not actually assign the new string pointer to the DOM reference, and then leave the old string sitting there in memory awaiting re-allocation? Is there a way to be sure I am killing the only and original copy?  Or is there in D2007 a means to tell it to wipe all unused memory from the heap? So I could release the DOM, and then tell it to wipe.   Or should I just get on with my next task and forget this because it is really not worth bothering.
61276
Today, once again, the  came to my attention and I have decided to try to  using XeLaTeX. The result is far from perfect, worse even than Chrome's rendering.  Is there a way I can improve the result? Is XeLaTeX and LuaLaTeX incapable of handling the Ponny?  :  \documentclass[]{article} \usepackage{lmodern} \usepackage{amssymb,amsmath} \usepackage{ifxetex,ifluatex} \usepackage{fontspec} \defaultfontfeatures{Mapping=tex-text,Scale=MatchLowercase} \IfFileExists{upquote.sty}{\usepackage{upquote}}{} \IfFileExists{microtype.sty}{\usepackage{microtype}}{} \usepackage[normalem]{ulem} \setmainfont{Doulos SIL}  \title{html - RegEx match open tags except XHTML self-contained tags - Stack Overflow} \date{} \author{StackOverflow}  \begin{document} \maketitle  Rege̿̔̉x-based HTML parsers are the cancer that is killing StackOverflow \emph{it is too late it is too late we cannot be saved} the trangession of a chi͡ld ensures regex will consume all living tissue (except for HTML which it cannot, as previously prophesied) \emph{dear lord help us how can anyone survive this scourge} using regex to parse HTML has doomed humanity to an eternity of dread torture and security holes \emph{using rege}x as a tool to process HTML establishes a brea\emph{ch between this world} and the dread realm of c͒ͪo͛ͫrrupt entities (like SGML entities, but \emph{more corrupt) a mere glimp}se of the world of reg​\textbf{ex parsers for HTML will ins}​tantly transport a p\emph{rogrammer's consciousness i}nto a w\emph{orl}d of ceaseless screaming, he comes\sout{, the pestilent sl}ithy regex-infection wil​\textbf{l devour your HT}​ML parser, application and existence for all time like Visual Basic only worse \emph{he comes he com}es \emph{do not fi}​ght h\textbf{e com̡e̶s, ̕h̵i}​s un̨ho͞ly radiańcé de\emph{stro҉ying all enli̍̈́̂̈́ghtenment, HTML tags \textbf{lea͠ki̧n͘g fr̶ǫm ̡yo​͟ur eye͢s̸ ̛l̕ik͏e liq}​uid p}ain, the song of re̸gular exp​re\sout{ssion parsing} will exti\emph{​nguish the voices of mor​\textbf{tal man from the sp}​here I can see it can you see ̲͚̖͔̙î̩́t̲͎̩̱͔́̋̀ it is beautiful t​}he f\texttt{inal snuf}fing o\emph{f the lie​\textbf{s of Man ALL IS LOŚ͖̩͇̗̪̏̈́T A}}\textbf{LL I​S L}OST th\emph{e pon̷y he come}s he c̶̮om\sout{es he co}\textbf{\sout{me}s t\emph{he} ich​}or permeat\emph{es al}l MY FAC\emph{E MY FACE ᵒh god n\textbf{o NO NOO̼}}\textbf{O​O N}Θ stop t\emph{he an​*̶͑̾̾​̅ͫ͏̙̤g͇̫͛͆̾ͫ̑͆l͖͉̗̩̳̟̍ͫͥͨ}e̠̅s\texttt{ ͎a̧͈͖r̽̾̈́͒͑e} n\textbf{​ot rè̑ͧ̌aͨl̘̝̙̃ͤ͂̾̆ ZA̡͊͠͝LGΌ ISͮ̂҉̯͈͕̹̘̱ T}O͇̹̺ͅƝ̴ȳ̳ TH̘\textbf{Ë͖́̉ ͠P̯͍̭O̚​N̐Y̡ H̸̡̪̯ͨ͊̽̅̾̎Ȩ̬̩̾͛ͪ̈́̀́͘ ̶̧̨̱̹̭̯ͧ̾ͬC̷̙̲̝͖ͭ̏ͥͮ͟Oͮ͏̮̪̝͍M̲̖͊̒ͪͩͬ̚̚͜Ȇ̴̟̟͙̞ͩ͌͝}S̨̥̫͎̭ͯ̿̔̀ͅ  \end{document}   UPDATE  Using the Doulos SIL font gets me something closer to what Firefox renders but still far from perfect.
62985
I have the following data:  http://example1.com    anchor text 1     http://example2.com    anchor text 2 http://example3.com    anchor text 3       And I would like the output to be:  http://example1.com    anchor text 1    &lt;a href="http://example1.com"&gt;anchor text 1&lt;/a&gt; http://example2.com    anchor text 2    &lt;a href="http://example1.com"&gt;anchor text 2&lt;/a&gt; http://example3.com    anchor text 3    &lt;a href="http://example1.com"&gt;anchor text 3&lt;/a&gt;   I have tried getting the code to substitute cells A1 and B1 in cell C1 like this:  ="&lt;a href="A1"&gt;B1&lt;/a&gt;"   However, I'm getting errors because of the equal sign and double quotes in the HTML code. I have tried using single quotes to escape it, but still no luck.  Anyone know how to do this? Your help is highly appreciated.
112694
What mysql functions are there (if any) to trim leading zeros from an alphanumeric text field?    Field with value "00345ABC" would need to return "345ABC".
1144
I have a bespoke Content Type pertaining to venues. These are not user-creatable; they are all created from importing a trusted third-party feed, which sanitised the titles before they come to me (so there's no risk of  or  here). The titles might, however, contain accented characters (é, ô etc), apostrophes (') or ampersands (&amp;); these are coming out as HTML escapes (so &amp;#039; instead of an apostrophe, &amp;amp; instead of an ampersand, etc).  The Content Type Venue has a field title, which is a Node module element, so doesn't allow me to mess with its display settings. In the Node template page, I can use substitutions in the display of this title, but I can't work out how to make it be the raw text version. The title is currently set to display as %node:title and I tried using %node:title:raw and %node:title-raw in case one of those would magically work, but they had no effect.  I saw something that looks like a potential solution at  on zerotodrupal.posterous.com, which attaches to the hooks hook_preprocess_page and hook_preprocess_node, creating a new method like  function hhhdarkelegance_custom_title($node) {       return check_markup(strip_tags($node-&gt;title, '&lt;em&gt;&lt;em&gt;'));   }   but, while that blog post looks like it will work well for named HTML tags, I'm not sure it will necessarily deal with HTML entities, which are what my problem is here. I suppose I could do the opposite to the blog-post code and replace out &amp;amp; to &amp; before display, but that feels really kludgy and, frankly, it would be nice to be able to do this just using a substitution, if possible.  Is there some way of achieving this that doesn't involve cutting code? If so, is  what is causing the HTML escapes? (The function description reads as though it's only causing the removal of HTML tags, which I am fine with either way — they won't occur in my node titles. I am wanting to stop escaping the HTML escapes, however.)  So how can I (on a specific Content Type, without worrying about security concerns) prevent Node titles from rendering HTML escape characters to the usual and just write the damn output to the page?  I did scan through several pages of similar-looking questions before posting and I couldn't find one that addressed this, so my apologies if someone has asked this already; if you point me towards it I'll be suitably embarrassed and try even harder next time. Thanks for your help, everyone!
115935
I have a form with a textarea. Users enter a block of text which is stored in a database.  Occasionally a user will paste text from Word containing smart quotes or emdashes. Those characters appear in the database as: â€“, â€™, â€œ ,â€  What function should I call on the input string to convert smart quotes to regular quotes and emdashes to regular dashes?   I am working in PHP.  Update: Thanks for all of the great responses so far. The page on Joel's site about encodings is very informative:   Some notes on my environment:  The MySQL database is using UTF-8 encoding. Likewise, the HTML pages that display the content are using UTF-8 (Update:) by explicitly setting the meta content-type.  On those pages the smart quotes and emdashes appear as a diamond with question mark.  Solution:  Thanks again for the responses. The solution was twofold:   Make sure the database and HTML files were explicitly set to use UTF-8 encoding. Use htmlspecialchars() instead of htmlentities().
17730
Is there a catchall function somewhere that works well for sanitizing user input for SQL injection and XSS attacks, while still allowing certain types of HTML tags?
48664
How can you strip non-ASCII characters from a string? (in C#)
43887
What's the best/most efficient way to extract text set between parenthesis? Say I wanted to get the string "text" from the string "ignore everything except this (text)" in the most efficient manner possible.  So far, the best I've come up with is this:  $fullString = "ignore everything except this (text)"; $start = strpos('(', $fullString); $end = strlen($fullString) - strpos(')', $fullString);  $shortString = substr($fullString, $start, $end);   Is there a better way to do this? I know in general using regex tends to be less efficient, but unless I can reduce the number of function calls, perhaps this would be the best approach? Thoughts?
47610
This has been confusing me for some time. With the advent of UTF-8 as the de-facto standard in web development I'm not sure in which situations I'm supposed to use the HTML entities and for which ones should I just use the UTF-8 character. For example,   em dash (–, &amp;emdash;) ampersand (&amp;, &amp;amp;) 3/4 fraction (¾, &amp;frac34;)   Please do shed light on this issue. It will be appreciated.