Closed GoogleCodeExporter closed 8 years ago
I appreciate your time to enter this issue. For cross site scripting
protection if a
value entered is considered not valid for the field type (an invalid e-mail
address
would be a fine example) the function which retrieves field values will return
an
empty string rather than invalid (and potentially malicious) data.
The values posted by a form are never handled anywhere in code. Only the
filtered
values are available. We could echo those values which are valid back to the
form if
all the other required values were not entered. But if a value was invalid, it
would
not be available in code to be echoed back to the form, nor should it.
Original comment by rdivilb...@gmail.com
on 29 Apr 2010 at 10:19
ASP changes made.
Need to parallel the changes in PHP
Original comment by rdivilb...@gmail.com
on 30 Apr 2010 at 12:25
Fixed ASP & PHP
Original comment by rdivilb...@gmail.com
on 30 Apr 2010 at 3:02
Original issue reported on code.google.com by
coty...@gmail.com
on 29 Apr 2010 at 9:14