4 ms·
AFAIK for JavaScript there is no systematic protection like for CSRF (CSRF token), but the use of a templating engine reduces the risk. You can also order a sca
by js4all 16y ago
AFAIK for JavaScript there is no systematic protection like for CSRF (CSRF token), but the use of a templating engine reduces the risk. You can also order a scanning service like http://www.godaddy.com/security/website-security.aspx http://www.godaddy.com/security/website-security.aspx
- kijinbear 16y ago+1 for template engines. Cheap scanning services only go so far. Any sane template engine should automatically escape all strings when outputting an HTML/XML document, unless the developer explicitly tells it not to. Django does this perfectly. A lot of other modern frameworks also has secure defaults. PHP is a PITA because it is a template engine in some sense, but it doesn't escape anything by default. PHP's last attempt at something like auto-escaping was magic quotes, which was an epic failure. The few times I need to write vanilla PHP, I end up defining an escaping function and use it instead of echo.
- DanielRibeiro 16y agoYou shouldn't forget that blacklisting is not enough. Whitelisting is usually as important (specially for displaying rss full of html), and there are far fewer open implementations.