0

I need to send a message from a Flash contact form to PHP. Do I need to encode characters like ' " < > & because of possible XSS attacks or something else?

2 Answers 2

0

Yes but not because of XSS for your case. You don't want to interfere your db query string which is using single or double quotes. Within PHP, escape your $_POST or $_GET vars with this

$myString = mysql_real_escape_string($myString);

If your outputting this data on an HTML page, do this on the output page

echo htmlentities($row['columnName'], ENT_QUOTES);

You may optionally do the above script before you insert it into the database too

1
  • Thank you! BTW: Could "hackers" access my server through the PHP when allowing those characters that are used in coding?
    – Tom
    Jan 23, 2012 at 0:23
0

Those characters are only special in an HTML context. If you do not output them as part of HTML, there's nothing special about them and there's no XSS risk. Only escape data for the context you use it in. If you send the data to PHP using JSON, you need to JSON encode characters that are special in JSON. If you output the data to HTML, you need to HTML escape special HTML characters. You don't need to escape characters that are special in HTML if there's no HTML context involved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.