Re: Security in displaying arbitrary HTML

[Vivek Khera]

>>>>> "SC" == Steven Champeon <[EMAIL PROTECTED]> writes:

SC> developers and designers) for Webmonkey:

SC>  http://hotwired.lycos.com/webmonkey/00/18/index3a.html

SC> If you want to see what sort of stuff the XSS problem opens you up for,
SC> just try appending ?tw=<script>alert("aha!");</script> to the URL above.

Why on earth would you take user input and output it verbatim to your
pages?  Rule number 1 of developing a web site is to never trust the
user's input values.  *Always* validate it against what you're
expecting.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Vivek Khera, Ph.D.                Khera Communications, Inc.
Internet: [EMAIL PROTECTED]       Rockville, MD       +1-301-545-6996
PGP & MIME spoken here            http://www.kciLink.com/home/khera/