SafeHTML – cleaning form input
Reading a couple of web-related security books at the moment.
One is Apache Security, by Ivan Ristic (mod_security), who I got to meet again last weekend. Will save a long review for another time (I’m not finished reading yet), suffice to say this is a must read if you’re doing anything around Apache. Particularily PHP developers, who tend to see just their small part of the stack (“Apache is the hosts problem right?”).
Also can’t say much about PHP-Sicherheit yet, other than I like what I’ve seen so far. What got me typing though was it’s mention of SafeHTML – an “anti-XSS HTML parser, written in PHP”, by Roman Ivanov, which I hadn’t seen before. In an odd way it’s kind of a product of Sitepointforums, given that it uses XML_HTMLSax, which basically got developed in this thread.
Still not entirely convinced though – one thing that puzzles me is it’s taking all the decisions about what HTML get’s stripped for you. Will it cope with a table tag with a large width, that effectively breaks a design, for example (OK – that’s not XSS but…)? Still investigating… Would also be good to see this hosted somewhere like Berlios or Sourceforge.