Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - PHP Nuke
Author Message
testy1
Involved
Involved


Joined: Apr 06, 2008
Posts: 484

PostPosted: Tue Apr 08, 2008 11:15 pm Reply with quote

could someone explain this to me please, the best way is to give an example.

I have taken the following from modules/Content/index.php in the latest version of RN.

I would just like to know if the second piece of code enhances the security or not.


Code:



$mytitle = check_html($mypage['title'], 'nohtml');
$mysubtitle = check_html($mypage['subtitle'], 'nohtml');
$mypage_header = check_html($mypage['page_header'], 'nocheck');
$mytext = check_html($mypage['text'], 'nocheck');
$mypage_footer = check_html($mypage['page_footer'], 'nocheck');
$mysignature = check_html($mypage['signature'], 'nocheck');



Code:



$mytitle = stripslashes(check_html($mypage['title'], "nohtml"));
$mysubtitle = stripslashes(check_html($mypage['subtitle'], "nohtml"));
$mypage_header = stripslashes(check_html($mypage['page_header'], ""));
$mytext = stripslashes(check_html($mypage['text'], ""));
$mypage_footer = stripslashes(check_html($mypage['page_footer'], ""));
$mysignature = stripslashes(check_html($mypage['signature'], ""));


Thanks
 
View user's profile Send private message
montego
Site Admin


Joined: Aug 29, 2004
Posts: 9453
Location: Arizona

PostPosted: Wed Apr 09, 2008 5:44 am Reply with quote

No. The reason is that the check_html() function already checks to see if stripslashes is needed, and if so, it does the job. Adding another stripslashes will simply remove the ability for you to have a valid backslash used within your content.

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
Gremmie
Former Moderator in Good Standing


Joined: Apr 06, 2006
Posts: 2415
Location: Iowa, USA

PostPosted: Wed Apr 09, 2008 7:01 am Reply with quote

If you aren't using RavenNuke however, I'm not sure. But what are you trying to do? Add stuff to the database or echo it back in HTML?

_________________
Only registered users can see links on this board! Get registered or login! - An Event Calendar for PHP-Nuke
Only registered users can see links on this board! Get registered or login! - A Google Maps Nuke Module 
View user's profile Send private message
montego
PostPosted: Wed Apr 09, 2008 7:15 am Reply with quote

Arrgghhh... yes, you are right Gremmie. For some reason I thought this was in the RN forums. Sorry about that.

What Gremmie said.... yes, they could be needed, but I think only if magic quotes is on assuming that we're only talking about where input from the end-user is concerned. There is really NO value on stripping slashes on data coming out from a database.
 
testy1
PostPosted: Wed Apr 09, 2008 5:13 pm Reply with quote

ok then, just trying to get a better understanding is all.thankyou.

is there a tut or post on this somewhere to learn more about it.
 
Gremmie
PostPosted: Wed Apr 09, 2008 6:53 pm Reply with quote

Well we could help you a bit more if you explain where the data came from (the database?, the user?), where it was going (the database?, the screen?), and what nuke flavor you have.
 
testy1
PostPosted: Wed Apr 09, 2008 8:19 pm Reply with quote

i was looking at it in rn latest but i was comparing it to the flat patched version, but obviously the check html function in rn is further enhanced, well im assuming anyway lol
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - PHP Nuke

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©