PHP And PDO preventing Javascript injection

Question

I have a site written in PHP utilizing PDO. I am using the bindParam() function to bind to a sql insert query:

("insert into Table (id, date, data) VALUES (?, ?, ?)")

but I am able to insert a string containing

"<script>window.location="google.com"</script>"

How to prevent this?

Thanks!!!

shamittomar · Accepted Answer · 2010-09-15 03:43:08Z

2

PDO is not going to stop you do that. You will need to yourself take care of the string:

If you do not want <script> tags at all, use strip_tags
If you want those tags but don't want them to execute, then use htmlentities

answered Sep 15, 2010 at 3:43

shamittomar

46.8k12 gold badges77 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Andrew67 · Accepted Answer · 2010-09-15 03:31:07Z

0

Assuming you mean

<script>window.location="google.com"</script>

You should worry about injection protection on row display, as you don't want to fill up the database with HTML entities.

Use htmlspecialchars()[1] on pages that display what's on the database.

[1] http://www.php.net/manual/en/function.htmlspecialchars.php

answered Sep 15, 2010 at 3:31

Andrew67

3572 silver badges7 bronze badges

2 Comments

Andy Hin Over a year ago

What do you mean? Shouldn't I prevent these from going into the DB in the first place?

Andrew67 Over a year ago

Well you can either filter on input to DB or filter on output to browser, just make sure you don't filter twice. My preference at the moment is to filter on output so as not to have the DB littered with HTML entities.

Collectives™ on Stack Overflow

PHP And PDO preventing Javascript injection

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related