PUBLIC MARKS with tags php & xss

HTML Purifier is a standards-compliant HTML filter library written in PHP.

Gareth Heyes détaille son cheminement pour construire une attaque XSS qui passe les défenses de PHP-IDS. PHP-IDS est une bibliothèque de détection, qui surveille les entrées à l'aide de regex et d'une centrifugeuse : cet élément abscons compare des valeurs valides et des valeurs dangereuses avec l'entrée courante pour évaluer la dangerosité d'une valeur qui passerait les regex initiales.

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications. Tired of using BBCode due to the current landscape of deficient or insecure HTML filters? Have a WYSIWYG editor but never been able to use it? Looking for high-quality, standards-compliant, open-source components for that application you're building? HTML Purifier is for you!

Standards-Compliant HTML Filtering

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant