Re: HTML Security Issue

Grahame Grieve wrote:
> 
> We are having a bit of a quandary about a security
> related issue. We have a standard web application
> that allows users to enter information, which is then
> redisplayed, possibly to other users.
> 
> We wish to stop users putting scripts into the
> text they enter (a security issue receiving press
> at the moment, which prompted us to revive this issue)
> 
> It seemed to us the best way to stop this was to
> convert any "<" to &lt; as we stored it in our
> database. However this gives a problem when putting
> the text entered back into the text box, as we
> cant tell the difference between s showing
> "text &lt; text" for what was originally "text < text"
> and the user actualy typing "text &lt;text"
> 
> There's several variations that arise with this problem.
> For performance reasons we'd rather store the text
> "html-safe" and back convert it when putting it into
> a text box.
> 
> Does any one have a good way of handling this problem?

Why not also convert '&' characyters entered by the user into '&amp;'
entities, then when it is reconverted, a '<' will be a '<' and a '&lt;'
will be '&lt;'

> 
> Grahame