Anti XSS Filter PHP

[Joopie]

What about strip_tags/htmlentries/real escape string

We don't need that hardcore function of you?

Also, Where is that post of kryptos, I wanna like it ;x

Edit: forgot filter_var...

[azaidi]

Owh okay.. What is XSS :P
I don't know anything about security xD

Pepijn =D

Javascript exploits like putting <script>alert('You suck')</script> in your motto in the client and then go to the Online Users page and look at your motto. If it isn't filtered it would give you an alert "You suck".

[nickymonsma]

True :p;PPPPPPP:P

[leenster]

Javascript exploits like putting <script>alert('You suck')</script> in your motto in the client and then go to the Online Users page and look at your motto. If it isn't filtered it would give you an alert "You suck".

You can also do that with room descriptions if your cms shows your rooms.
Posted via Mobile Device

[pepijndut]

Thanks everyone =D. I now know what XSS is :P

Pepijn =D

[azaidi]

You can also do that with room descriptions if your cms shows your rooms.
Posted via Mobile Device

There are some more things but the motto exploit is the most important one.

[Pure]

i hurd u no like indents or whitespace

[djboetz]

XSS may refer to:
Cross-site scripting, a vulnerability in web applications which attackers may exploit to steal users' information
XSS file, a Microsoft Visual Studio Dataset Designer Surface Data file
Assan language, has the ISO 639-3 code xss

[EvilCoder]

This is real crap.

You practicly stole this injection filter from web, and its so useless.

foreach($_GET as $key => $value){
  $_GET[$key] = mysql_real_escape_string(htmlspecialchars(addslashes($value),ENT_QUOTES));
}
foreach($_POST as $key => $value){
  $_POST[$key] = mysql_real_escape_string(htmlspecialchars(addslashes($value),ENT_QUOTES));
}
foreach($_REQUEST as $key => $value){
  $_REQUEST[$key] = mysql_real_escape_string(htmlspecialchars(addslashes($value),ENT_QUOTES));
}

Past this in your config.php file. And you're done. That is all useless crap.

What about strip_tags/htmlentries/real escape string

We don't need that hardcore function of you?

Also, Where is that post of kryptos, I wanna like it ;x

Edit: forgot filter_var...

Agree. He is just reposting functions with some function.

WTH?! Nothing is even calling the function: function RemoveXSS($val).....
You're really dumb with PHP. You need to call the function if you add it.

omg?!?!. This guy thinks php does all the work itself >_<'