Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Escape From New York

Avatar for Tom J Nowell Tom J Nowell
November 01, 2015
Technology
0
730

Escape From New York

A talk on escaping and security in WordPress and PHP

Avatar for Tom J Nowell

Tom J Nowell

November 01, 2015
Tweet

More Decks by Tom J Nowell

See All by Tom J Nowell
Using Blocks Outside The Editor
Avatar for Tom J Nowell tarendai
0
1k
Composer_and_WordPress__1_.pdf
Avatar for Tom J Nowell tarendai
0
84
REST APIs for Absolute Beginners
Avatar for Tom J Nowell tarendai
0
980
VVV 2
Avatar for Tom J Nowell tarendai
0
780
WordCamp Europe 2016 - Handling Anxiety
Avatar for Tom J Nowell tarendai
1
490
WP The Right Way
Avatar for Tom J Nowell tarendai
0
1k
Code Deodorant 2014
Avatar for Tom J Nowell tarendai
1
730
Adv WP CLI
Avatar for Tom J Nowell tarendai
0
720
WP CLI
Avatar for Tom J Nowell tarendai
0
670

Other Decks in Technology

See All in Technology
【AWS reInvent 2025 関西組 事前勉強会】re:Inventの“感動と興奮”を思い出してモチベ爆上げしたいです
Avatar for Toshiki Terai ttelltte
0
130
Copilotの精度を上げる！カスタムプロンプト入門.pdf
Avatar for Izumu KUSUNOKI ismk
10
3.2k
日々のSlackアラート確認運用をCustom Chat Modesで楽にした話 / 日々のSlackアラート確認運用をCustom Chat Modesで楽にした話
Avatar for Imamoto Hikaru imamotohikaru
0
330
「データ無い！ 腹立つ！ 推論する！」から 「データ無い！ 腹立つ！ データを作る」へ チームでデータを作り、育てられるようにするまで / How can we create, use, and maintain data ourselves?
Avatar for moznion moznion
3
850
Digitization部 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
5.9k
Amazon ECS デプロイツール ecspresso の開発を支える「正しい抽象化」の探求 / YAPC::Fukuoka 2025
Avatar for FUJIWARA Shunichiro fujiwara3
6
580
仕様駆動 x Codex で 超効率開発
Avatar for Izumu KUSUNOKI ismk
2
1.3k
QAエンジニアがプロダクト専任で チームの中に入ると。。。？/登壇資料（杉森 太樹）
Avatar for Hacobu hacobu
PRO
0
180
バグと向き合い、仕組みで防ぐ
Avatar for rina ____rina____
0
240
The Twin Mandate of Observability
Avatar for Charity Majors charity
1
1.3k
開発者が知っておきたい複雑さの正体/where-the-complexity-comes-from
Avatar for Ryo Tomidokoro hanhan1978
6
2.4k
マウントとるやつ、リリースするやつ
Avatar for おーつき otsuki
1
110

Featured

See All Featured
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
73
11k
Building a Modern Day 
E-commerce SEO Strategy
Avatar for Aleyda Solis aleyda
45
8k
The MySQL Ecosystem @ GitHub 2015
Avatar for Sam Lambert samlambert
251
13k
The Cost Of JavaScript in 2023
Avatar for Addy Osmani addyosmani
55
9.2k
Visualization
Avatar for Eitan Lees eitanlees
150
16k
Stop Working from a Prison Cell
Avatar for Chris Michel hatefulcrawdad
272
21k
Scaling GitHub
Avatar for Zach Holman holman
463
140k
A better future with KSS
Avatar for Kyle Neath kneath
239
18k
Unsuck your backbone
Avatar for Amy Palamountain ammeep
671
58k
Site-Speed That Sticks
Avatar for Harry Roberts csswizardry
13
960
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
127
54k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
95
14k

Transcript

  1. Escape From New York Tom J Nowell

  2. Validation Sanitisation Escaping

  3. Validation: Is this what it claims to be?

  4. Sanitisation: Lets clean up this input

  5. Escaping: Making output safe

  6. WordPress.com VIP VIP Wrangler - @tarendai

  7. '; DROP TABLE votes'

  8. Search Results For: <?php echo $_GET[‘s’]; ?>

  9. Search Results For: <?php echo $_GET [‘s’]; ?>

  10. <b>Test</b>

  11. <b>Test</b>

  12. <script>alert(“hey”);</script>

  13. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  14. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  15. How to Escape

  16. Sanitize early Escape Late Escape Often

  17. No Data is Safe

  18. <script src='//peniscorp.com/topkek.js'> </script>

  19. Escape Everything..?

  20. echo $var; echo esc_html( $var );

  21. class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”

  22. href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”

  23. wp_kses & wp_kses_post

  24. echo apply_filters( ‘the_content’ wp_kses_post( $content ) );

  25. tomjn.com/escaping

  26. WordPress.com VIP VIP Wrangler - @tarendai

  27. automattic.com/work-with-us/vip-wrangler/

  28. Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com