2 replies to this topic

[Terminum]

I'm looking for an add-on that will prevent XSS attacks without diminishing functionality of the Administration Tool. I've read their are problems with Anti XSS, so I was considering [TiM's] Safer Database Input Method. But this says that it filters all html, and I would like to enter HTML in product descriptions through the administration tool.



[TiM's] Safer Database Input Method changes the following code from /catalog/includes/functions/database.php:

  function tep_db_input($string, $link = 'db_link') {
    global $$link;

    if (function_exists('mysql_real_escape_string')) {
      return mysql_real_escape_string($string, $$link);
    } elseif (function_exists('mysql_escape_string')) {
      return mysql_escape_string($string);
    }

    return addslashes($string);
  }:

Replaced with:

function tep_db_input($string, $link = 'db_link', $skip_stripping = false) {
    global $$link;
    
    // Strip HTML and PHP tags from string
    if (!$skip_stripping) $string = strip_tags($string);
    
    if (function_exists('mysql_real_escape_string')) {
      return mysql_real_escape_string($string, $$link);
    } elseif (function_exists('mysql_escape_string')) {
      return mysql_escape_string($string);
    }
    
    return addslashes($string);
  }

The README says:


If you for any reason want to store HTML in the database, make sure you
manipulate the tep_db_input() command with the third optional parameter
like the following.

This...

$example_query = tep_db_query("update myTable set column='". tep_db_input($var) ."' where this='that' limit 1;");

Becomes...

$example_query = tep_db_query("update myTable set column='". tep_db_input($var, 'db_link', true) ."' where this='that' limit 1;");

I'm not very familiar with sql and I don't know what this means. I just want to be able to use HTML in product descriptions in the admin tool. Any ideas for what I should do?

[spooks]

Terminum, on 20 November 2009, 18:50, said:

If you make code changes on the catalog side they do not apply to admin.


But I would use the htacess method detailed in the contrib linked in this thread. And make sure you add the other security changes too. [img]http://forums.oscommerce.com/public/style_emoticons/default/smile.gif[/img]

[Terminum]

spooks, on 20 November 2009, 19:08, said:

If you make code changes on the catalog side they do not apply to admin.

Ha, thanks that's great. I'm working my way through your other post right now! Thanks for the help.