Page 3 of 3
Re: Security Resources
Posted: Wed Mar 14, 2012 10:10 am
by Mordred
Christopher wrote:For example, do you recommended using mb_convert_encoding() to convert everything to UTF8?
Oh yes, for <5.4.0 surely. Did you know about
this?
You should use a wrapper function anyway, who wants to type so much code every time? Inside, something like:
Code: Select all
function HtmlEscape($s) {
mb_substitute_character("none");
$s = mb_convert_encoding($s, 'UTF-8', 'UTF-8');
return htmlspecialchars($s, ENT_QUOTES, 'UTF=8');
}
Re: Security Resources
Posted: Wed Mar 14, 2012 4:23 pm
by Christopher
Mordred wrote:Christopher wrote:For example, do you recommended using mb_convert_encoding() to convert everything to UTF8?
Oh yes, for <5.4.0 surely. Did you know about
this?
Excellent information!
Can you explain what is going on in these two lines?
Code: Select all
mb_substitute_character("none");
$s = mb_convert_encoding($s, 'UTF-8', 'UTF-8');
Re: Security Resources
Posted: Thu Mar 15, 2012 3:27 am
by Mordred
"Convert the string from utf-8 to utf-8 making sure you remove any character sequences that are not valid for utf-8"
I must add that this must be accompanied by strict enforcement of utf-8 encoding to the client to avoid legitimate clients sending you their weird Elbonian encoding and getting their data mangled. This is not related to security, just to the proper functioning of the site. An attacker will not send you well-formed utf-8 because he's a nice guy, that's why you don't trust him to, and that's why you force clean his input.
Re: Security Resources
Posted: Thu Jul 25, 2013 8:48 pm
by ragax
Chris Shiflett's Security Workbook
Excellent PDF covering security in PHP.
Is anyone aware of another good book on the topic? Yes Chris's book is excellent, but I've been wondering if there have been new developments since it came out in 2005, and I've been feeling hungry for more as I get back in the saddle to tackle new projects.
Re: Security Resources
Posted: Tue Jan 21, 2014 4:16 am
by Maugrim_The_Reaper
Re: Security Resources
Posted: Thu Mar 10, 2016 6:24 am
by munkitkat
This is an excellent source for PHP security. I'm impressed.