background preloader

Security

Facebook Twitter

Apache

Bandwidth. Testing. Nsi. Handle text in a secure fashion. When handling and outputting text in HTML, you need to be careful that proper filtering or escaping is done.

Handle text in a secure fashion

Otherwise there might be bugs when users try to use angle brackets or ampersands, or worse you could open up XSS exploits. When handling data, the golden rule is to store exactly what the user typed. When a user edits a post they created earlier, the form should contain the same things as it did when they first submitted it. This means that conversions are performed when content is output, not when saved to the database (be sure to read the db_query() documentation on how to use the database API securely).