How can I accomplish the following.
For example lets say I already have a template that checks to see if the user has entered a link if not it will not display the link template if so display the link template?
A:
<?php
$enteredLink = isset( $_POST['enteredLink'] ) ?1:0;
if ( $enteredLink ) {
?>
<a href="<?php echo htmlentities($_POST['enteredLink']);?>">link</a>
<?php
}
?>
You need to set a variable to a boolean, use an if statement and if it was entered, just output anything, otherwise don't.
meder
2009-10-05 02:14:43
That's an open invitation to XSS. As a general rule of thumb, you should never emit form data unencoded to the HTML.
John Cavan
2009-10-05 02:18:36
surrounding the $_POST entry with htmlentities() should resolve that potential. Outside of that the code should do what your after.
canadiancreed
2009-10-05 02:27:29
Of course I recommend that you sanitize, but honestly there are hundreds of simple questions on StackOverflow where XSS isn't taken into account because it's outside of the scope of the original question.
meder
2009-10-05 02:27:51
@meder: I suppose that's true, but I'm new to Stack Overflow. :) However, I think it's probably better to hammer security into web developers at every opportunity because it's the single most important thing they can learn. It doesn't matter how functional their code is if a 10 year old script kiddy takes them down. Net effect, I think it's always in scope.
John Cavan
2009-10-05 02:42:40
@canadiancreed: It doesn't resolve putting script into the link and that's the heart of XSS.
John Cavan
2009-10-05 02:45:36
+1
A:
The basics are:
<?PHP
if(isset($_REQUEST['supplied_link']))
{
// do something
}
else
{
// do another thing
}
However, it is very important to actually validate that link in some manner, particularly to ensure that it is not script code but is, in fact, a link. I chose $_REQUEST because it handles both POST and GET, but you could use $_POST as meder described.
In terms of validating, if you're using PHP 5, you can just use strpos to look for http:// at the front. Remember, in this case, the return value would be 0 (zero) for the desired match and either FALSE or > 0 for a failure. You could do a lot more than this (such as validating the URL against DNS, Spam blockers, etc), but this is the bare minimum.
John Cavan
2009-10-05 02:27:07