0

I have a question. I want to store custom css files created by users on my website. The question is - where i should store them for better performance ? inside DB rows (MySQL) or as a local file with dynamic name?

Improve this question
3
  • 2
    as per opinion local files Commented Apr 4, 2014 at 10:43
  • 2
    You should never use files, before you're completely ready to protect your local storage and you really know what you're doing. And by asking that question it seems like you should definitely forget about exposing your filesystem to the web user! Commented Apr 4, 2014 at 10:48
  • 1
    You always can create manager by your own of this css files. Basically it better then store in db - no XSS will be, because you will store it as text and add link to your page. Of course for someone it's not good idea but if you know about file-permissions enough - store in files better case then store in db. Commented Apr 4, 2014 at 13:28

1 Answer 1

Reset to default
2

DB is what I would prefer, but if you are letting users customize their css then keep in mind that before saving it into db, remove all special chars using htmlchar() and while using it back replace them with what they were earlier. This reduces chances of XSS attack.

Further details: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

Yeah, i'm aware of that :>
"while using it back replace them with what they were earlier" - wouldn't that just recreate the payload?
For storing any text - string escape will do its job, but on viewing it can be trouble. And yes, storing in db sometimes good idea but not for all cases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.