Php: How can I prevent attacks from url links written by users?

Question

When a user enters a web url in a comment, that url becomes a link.

How do I prevent attacks from those links? any measures I can take?

thanx

Answer 1

There is nothing you can do except moderation. There is no way for a computer to determine if a link is sane or not. You can check against blacklists, you can check for some words in the domain, but other than that there's not much you can do, sorry...

Answer 2

1. You can write your own filtering system that flags posts based on spam words, and checks links for spam or adult related stuff

2. Use a 3rd party tool like Aksimet that checks for you

3. Use a moderation system so that any post with a link has to be approved by you.

4. All of the above. You could even throw a CAPTCHA in there as well to slow down bots.

Answer 3

don't allow link tags in comments? use the php strip_tagsfunction to remove html tags from submitted comments (you can add a list of tags that are allowed to the function, too).

Answer 4

You could use a blacklist (which is not going to catch most things), a whitelist (which is going to block most non-harmful links), or a redirect screen that warns the user "Don't be an idiot, this link might be malicious" (which doesn't prevent the links, but lets you say you warned the user and it's their own fault). Pick your poison.

Answer 5

This will sanitize your URL locally but will have zero impact on malicious external sites if the user clicks the link:

$url = "http://www.mytesturl.com";
$url = filter_var($var, FILTER_SANITIZE_URL);

The filter will remove all characters, except letters, digits and $-.+!'(),{}|\\^~[]`<>#%";/?:@&=

Answer 6

Check out mollom.com, this 3rd-party service will prompt the user for CAPTCHA only if it appears as spam.