News for hackers. Stuff that matters.

A comment on Cross-Site Scripting? In PHP Notices? It's more likely than you think.

Re:Cross-Site Scripting? In PHP Notices? It's more likely th... by dave1010uk on Thursday August 18, 2011 @04:10AM (#2898396)
This is an example of CWE-81: "Improper Neutralization of Script in an Error Message Web Page" [1].

For those of you working with WordPress, this is the code you need in wp-config.php to log errors but not show them in web pages:

    define('WP_DEBUG', true);
    define('WP_DEBUG_DISPLAY', false);
    define('WP_DEBUG_LOG', true);
[1] http://cwe.mitre.org/data/definitions/81.html
[ Parent | on HN ]

There are no comments on this comment yet.