CodeIgniter – why use xss_clean

by

xss_clean() is extensive, and also silly. 90% of this function does nothing to prevent XSS. Such as looking for the word alert but not document.cookie. No hacker is going to use alert in their exploit, they are going to hijack the cookie with XSS or read a CSRF token to make an XHR.

However running htmlentities() or htmlspecialchars() with it is redundant. A case where xss_clean() fixes the issue and htmlentities($text, ENT_COMPAT, 'UTF-8') fails is the following:

<?php
print "<img src="https://stackoverflow.com/questions/5337143/$var">";
?>

A simple poc is:

http://localhost/xss.php?var=http://domain/some_image.gif’%20onload=alert(/xss/)

This will add the onload= event handler to the image tag. A method of stopping this form of XSS is htmlspecialchars($var,ENT_QUOTES); or in this case xss_clean() will also prevent this.

However, quoting from the xss_clean() documentation:

Nothing is ever 100% foolproof, of
course, but I haven’t been able to get
anything passed the filter.

That being said, XSS is an output problem not an input problem. For instance, this function cannot take into account that the variable is already within a <script> tag or event handler. It also doesn’t stop DOM Based XSS. You need to take into consideration how you are using the data in order to use the best function. Filtering all data on input is a bad practice. Not only is it insecure but it also corrupts data which can make comparisons difficult.

More Related Contents:

  1. xss attack on a php page
  2. How print in Jquery / Datatables [closed]
  3. How can I sanitize user input with PHP?
  4. What are the best practices for avoiding xss attacks in a PHP site [closed]
  5. The ultimate clean/secure function
  6. Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?
  7. Set up the base url in codeigniter
  8. Best way to defend against mysql injection and cross site scripting
  9. How can I properly escape HTML form input default values in PHP?
  10. “slash before every quote” problem [duplicate]
  11. How do you set up use HttpOnly cookies in PHP
  12. Codeigniter CSRF – how does it work
  13. Php condition doesn't work for html [closed]
  14. Needle in a Haystack for Php [closed]
  15. Divide php echo rows into 3 columns
  16. How to insert images into a database using PHP [closed]
  17. (PHP) Warning: file_get_contents() [function.file-get-contents]: couldn’t resolve host name
  18. How do you parse and process HTML/XML in PHP?
  19. Multiple inputs with same name through POST in php
  20. How do I use password hashing with PDO to make my code more secure? [closed]
  21. How to set proper codeigniter base url?
  22. PHP Undefined Index [duplicate]
  23. UTF-8 encoded html pages show � (questions marks) instead of characters
  24. PHP: How To Disable Dangerous Functions
  25. codeigniter, result() vs. result_array()
  26. How to prevent multiple logins in PHP website
  27. Javascript function post and call php script
  28. Object of class stdClass could not be converted to string
  29. Safe alternatives to PHP Globals (Good Coding Practices)
  30. Decoding numeric html entities via PHP

Leave a Comment