Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Escape From New York

Avatar for Tom J Nowell Tom J Nowell
November 01, 2015
Technology
0
710

Escape From New York

A talk on escaping and security in WordPress and PHP

Avatar for Tom J Nowell

Tom J Nowell

November 01, 2015
Tweet

More Decks by Tom J Nowell

See All by Tom J Nowell
Using Blocks Outside The Editor
Avatar for Tom J Nowell tarendai
0
960
Composer_and_WordPress__1_.pdf
Avatar for Tom J Nowell tarendai
0
76
REST APIs for Absolute Beginners
Avatar for Tom J Nowell tarendai
0
970
VVV 2
Avatar for Tom J Nowell tarendai
0
760
WordCamp Europe 2016 - Handling Anxiety
Avatar for Tom J Nowell tarendai
1
470
WP The Right Way
Avatar for Tom J Nowell tarendai
0
1k
Code Deodorant 2014
Avatar for Tom J Nowell tarendai
1
710
Adv WP CLI
Avatar for Tom J Nowell tarendai
0
690
WP CLI
Avatar for Tom J Nowell tarendai
0
650

Other Decks in Technology

See All in Technology
Goss: Faiss向けの新しい本番環境対応 Goバインディング #coefl_go_jp
Avatar for 弁護士ドットコム bengo4com
1
1.4k
見てわかるテスト駆動開発
Avatar for Recruit recruitengineers
PRO
6
2.2k
TypeScript入門
Avatar for Recruit recruitengineers
PRO
33
11k
知られざるprops命名の慣習 アクション編
Avatar for uhyo uhyo
11
2.8k
Understanding Go GC #coefl_go_jp
Avatar for 弁護士ドットコム bengo4com
1
1.1k
DeNA での思い出 / Memories at DeNA
Avatar for Kuniwak orgachem
PRO
6
1.9k
AWSで推進するデータマネジメント
Avatar for かわなご kawanago
0
520
JavaScript 研修
Avatar for Recruit recruitengineers
PRO
6
1.3k
実践アプリケーション設計 ③ドメイン駆動設計
Avatar for Recruit recruitengineers
PRO
13
3.8k
Figma + Storybook + PlaywrightのMCPを使ったフロントエンド開発
Avatar for Yuji Yamaguchi yug1224
10
3.4k
【５分でわかる】セーフィー エンジニア向け会社紹介
Avatar for Safie safie_recruit
0
30k
実践AIガバナンス
Avatar for Asei Sugiyama asei
3
250

Featured

See All Featured
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
6.6k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
Avatar for Morgane Peng morganepeng
131
19k
Become a Pro
Avatar for Speaker Deck speakerdeck
PRO
29
5.5k
Side Projects
Avatar for Sacha Greif sachag
455
43k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
12k
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
6.6k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
231
18k
The Art of Delivering Value - GDevCon NA Keynote
Avatar for David Neal reverentgeek
15
1.6k
KATA
Avatar for Megan Lloyd mclloyd
32
14k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
77
5.9k
Practical Tips for Bootstrapping Information Extraction Pipelines
Avatar for Matthew Honnibal honnibal
PRO
23
1.4k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
70
11k

Transcript

  1. Escape From New York Tom J Nowell

  2. Validation Sanitisation Escaping

  3. Validation: Is this what it claims to be?

  4. Sanitisation: Lets clean up this input

  5. Escaping: Making output safe

  6. WordPress.com VIP VIP Wrangler - @tarendai

  7. '; DROP TABLE votes'

  8. Search Results For: <?php echo $_GET[‘s’]; ?>

  9. Search Results For: <?php echo $_GET [‘s’]; ?>

  10. <b>Test</b>

  11. <b>Test</b>

  12. <script>alert(“hey”);</script>

  13. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  14. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  15. How to Escape

  16. Sanitize early Escape Late Escape Often

  17. No Data is Safe

  18. <script src='//peniscorp.com/topkek.js'> </script>

  19. Escape Everything..?

  20. echo $var; echo esc_html( $var );

  21. class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”

  22. href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”

  23. wp_kses & wp_kses_post

  24. echo apply_filters( ‘the_content’ wp_kses_post( $content ) );

  25. tomjn.com/escaping

  26. WordPress.com VIP VIP Wrangler - @tarendai

  27. automattic.com/work-with-us/vip-wrangler/

  28. Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com