Downloaded 17 times
More Related Content
Similar to Rabin Shrestha: Data Validation and Sanitization in WordPress
Rabin Shrestha: Data Validation and Sanitization in WordPress
- 2. Data Validation AndSanitization Presented By: Rabin Shrestha sun.ravi90@gmail.com
- 3. Overview Definitions Why Data Validationand Sanitization? Difference between Data Validation and Sanitization Golden rules Some helper functions in codex
- 4. Definitions Data Validation: Datavalidation is to make sure that we receive what we expect to receive before saving it to database. Data Sanitization: Make the data sane before use i.e. before storing to the database or echoing it to browsers(escaping)
- 5. Why Validate andSanitize Data? Hackers can inject various script (sql injection) or XSS(Cross-site Scripting) <script>alert('hacked')</script> <script>alert(document.cookie)</script>
- 6. Why Validate andSanitize Data? Can break the output of the website •Use of single quote, double quote can break the output Spread malware
- 7. Difference Data Validation: Ifthe data is valid we accept it if not we reject it. Data Sanitization: In contrast to data validation, sanitization don‟t reject the whole data but strips the evil tags and encodes the tags before echoing it to browser.
- 8.
- 9. Lets see thisexample Source: http://devotepress.com
- 10. Remember Golden Rule Ruleno. 1: Never , Ever, Trust your users Rule no. 2: Validate/sanitize all inputs and escape all outputs Rule no.3: Trust WordPress
- 11. What does trustWordpress mean? Functions like the_title(),the_permalink(), the_title_attribute(), the_content() are already escaped by WordPress and are safe depending upon context. But custom data are not safe e.g get_post_meta()
- 12. Some helper Escaping functions Esc_attr(): Escapes content to be contained inside HTML attributes e.g, title, rel etc. Encodes < > & “ „. Esc_textarea(): Encodes text for use inside <text area> element. Uses htmlspecialchars function of PHP.
- 13. Some helper Escaping functions contd.. This text contain <script type="text/javascript">alert("XSS");</script> here! Esc_url(‘ $url’,(array)$protocols’): Sanitizes url. Rejects url‟s that don‟t have one of the provided whitelisted protocols.(defaulting to http, https, ftp, ftps, mailto, news, irc etc)
- 14. Some helper Escaping functions contd.. Esc_html():This function encodes < > & ” „ (less than, greater than, ampersand, double quote, single quote), letting the browser render it instead of interpreting it. Esc_js(): Escape single quotes, htmlspecialchar “ < > &. Intended to be used in inline js. For example onclick=“do something”.
- 15. Some helper inputvalidating functions Intval( $int ): Ensures the number is integer. Absint( $int ): Ensures the number is non- negative. Sanitize_text_field(): Strips out extra white space,tabs, line breaks and strips tags.
- 16. Some helper inputvalidating functions condt.. Wp_kses_post(): Sanitize content for allowed HTML tags for post content. wp_kses($string, $allowed_html, $allowed_ protocols):Only allowed html tags passed as argument are accepted.
- 17. Some helper inputvalidating functions condt.. Is_email( $email ): Returns true if the email address is valid. Esc_url_raw(): Escapes url that are to be saved to database. Note: Esc_url is intended for output purpose while esc_url_raw is intented for database storage. Also esc_url doesnot encodes html entities.
- 18.
- 19.