search

adamwathan / form

Super basic form HTML builder, only really exists so I can pull it in for some other more useful projects.
MIT License
232 stars 117 forks source link

XSS Vulnerabilities #48

Closed EAnushan closed 9 years ago

EAnushan commented 9 years ago

I believe the textarea input is vulnerable to xss. It uses $value to between the textarea tags. We haven't escaped this value. We need to be using htmlentities($output, ENT_QUOTES, 'UTF-8') to escape any user provided output, as none of it should be able to break the html.

There are other locations, other than textarea where we should be doing this escaping. Anywhere we accept user/developer input and render it should be escaped.

adamwathan commented 9 years ago

Thanks for the heads up, feel free to submit a PR if you'd like, otherwise I'll try and get to it today! Thanks!