Quote from: rthrash at Aug 04, 2009, 09:52 AM
Quote from: rfoster at Aug 04, 2009, 09:20 AM
Maybe this anti-xss code should be worked into the next version of eForm. It could be on by default, with an option to disable it if you had a reason to do so and knew what you were doing.
That makes a lot of sense indeed. 
Hmmm. Almost. The documentation states that the following datatypes are allowed:
* string - No specific validation besides checking if it's empty if the field is required.
* date - Checks if it is a valid date (based on php's strtotime() function)
* integer - Checks if it is a number (does not check if it is in fact an integer)
* float - Checks if it is a number
* email - Checks if it's a valid email address using a simple regular expression
* file - (for file upload input) - checks if a size error occurs, does not currently check file type
* html - Same as string except that it converts line endings (\n) to <br /> tags
The
first eFormHelpPreventXSS function I posted strips all html from the input, and
the most recent version doesn’t allow any html to be processed at all - so you wouldn’t quite get what you wanted when specifying html as the datatype, for example.
Maybe a better approach would be to have one new datatype, which would be the default rather than string:
* cleanstring - strips any valid html, php or xml from the input and escapes html characters.
The code for this could be based on my first function
To help prevent XSS a new filter could be introduced that could be used on individual fields:
#NOCODE - prevents processing of a field if it contained any embedded html, php or xml.
The code for this could be based on the strip_tags bit of my second function.
MODX Staff