News for hackers. Stuff that matters.

A comment on Shield, A Security-Minded PHP Microframework.

Re:Shield, A Security-Minded PHP Microframework by Kudos on Friday July 27, 2012 @07:57AM (#4300951)
> Filter values based on filter types (supported are: email, striptags)

Striptags is not a security tool, it is a presentation tool.

> Output filtering on all values (preventing XSS)

I'm still trying to figure out how you've implemented this.

[ Parent | on HN ]
Re:Shield, A Security-Minded PHP Microframework by jarnix on Friday July 27, 2012 @08:09AM (#4300980)
Here is the escaping :

https://github.com/enygma/shieldframework/blob/master/Shield...

at this line :

$value = htmlspecialchars($value);

[ Parent | on HN ]
Re:Shield, A Security-Minded PHP Microframework by Kudos on Friday July 27, 2012 @08:15AM (#4300995)
That could do with being mentioned in the README, a large part of the problem with PHP is developers not knowing what method to use to sanitise strings. After seeing striptags mentioned explicitly, I expected the worst.
[ Parent | on HN ]
Re:Shield, A Security-Minded PHP Microframework by JohnHaugeland on Friday July 27, 2012 @09:53AM (#4301383)
He used DES for session security.

That's the worst.

[ Parent | on HN ]
Re:Shield, A Security-Minded PHP Microframework by Kudos on Friday July 27, 2012 @10:47AM (#4301661)
https://github.com/enygma/shieldframework/commit/44d9fc7e981...
[ Parent | on HN ]