The curiosity killed the cat

http://blog.sucuri.net/2009/08/curiosity-killed-cat.html

by fossguy • 17 years ago

11 4 17 years ago

blog.sucuri.net

ars• 17 years ago

"We took the approach to htmlspecialchars() every single GET/POST variable even before processing them."

Didn't PHP magic_quotes prove that that is a really bad idea?

sucuri22• 17 years ago

PHP magic_quotes proved that doing that by default for every application is a bad idea. Plus, lots of developers weren't even aware of that...

In the case of our specific tools (with some limited user input), it worked great.

_cbsz• 17 years ago

I bet those text-based browsers aren't subject to the same level of security audits as the more popular ones. I hope they're sandboxing said browsers properly...

sucuri22• 17 years ago

In our case, we audited and were very careful with the data... Who knows what other sites are doing. A funny note is that since I published that article, the number of attempts increased :)

The curiosity killed the cat

Related Stories