Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Escape From New York

Avatar for Tom J Nowell Tom J Nowell
November 01, 2015
Technology
0
690

Escape From New York

A talk on escaping and security in WordPress and PHP
Avatar for Tom J Nowell

Tom J Nowell

November 01, 2015
Tweet

More Decks by Tom J Nowell

See All by Tom J Nowell
Using Blocks Outside The Editor
Avatar for Tom J Nowell tarendai
0
930
Composer_and_WordPress__1_.pdf
Avatar for Tom J Nowell tarendai
0
69
REST APIs for Absolute Beginners
Avatar for Tom J Nowell tarendai
0
940
VVV 2
Avatar for Tom J Nowell tarendai
0
730
WordCamp Europe 2016 - Handling Anxiety
Avatar for Tom J Nowell tarendai
1
450
WP The Right Way
Avatar for Tom J Nowell tarendai
0
1k
Code Deodorant 2014
Avatar for Tom J Nowell tarendai
1
700
Adv WP CLI
Avatar for Tom J Nowell tarendai
0
670
WP CLI
Avatar for Tom J Nowell tarendai
0
630

Other Decks in Technology

See All in Technology
エンジニア採用から始まる技術広報と組織づくり/202506lt
Avatar for Ichiro Nishiuma nishiuma
8
1.7k
「どこにある？」の解決。生成AI(RAG)で効率化するガバメントクラウド運用
Avatar for Toru_Kubota toru_kubota
2
390
上長や社内ステークホルダーに対する解像度を上げて、より良い補完関係を築く方法 / How-to-increase-resolution-and-build-better-complementary-relationships-with-your-bosses-and-internal-stakeholders
Avatar for MADOX madoxten
13
7.6k
Grafana MCP serverでなんかし隊 / Try Grafana MCP server
Avatar for kohbis kohbis
0
340
新卒3年目の後悔 〜機械学習モデルジョブの運用を頑張った話〜
Avatar for camay kameitomohiro
0
220
AWS全冠したので振りかえってみる
Avatar for tajimon tajimon
0
140
Devin(Deep) Wiki/Searchの活用で変わる開発の世界観/devin-wiki-search-impact
Avatar for tomoki10 tomoki10
0
310
Tensix Core アーキテクチャ解説
Avatar for Tenstorrent Japan tenstorrent_japan
0
360
本部長の代わりに提案書レビュー！ KDDI営業が毎日使うAIエージェント「A-BOSS」開発秘話
Avatar for みのるん minorun365
PRO
14
1.7k
Amplifyとゼロからはじめた AIコーディング 成果と展望
Avatar for k.masachika mkdev10
1
220
CIでのgolangci-lintの実行を約90%削減した話
Avatar for KazukiHayase kazukihayase
0
230
Long journey of Continuous Delivery at Mercari
Avatar for Hisaharu Ishii hisaharu
1
210

Featured

See All Featured
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
46
14k
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.3k
Designing for Performance
Avatar for Lara Hogan lara
609
69k
ReactJS: Keep Simple. Everything can be a component!
Avatar for Pedro Nauck pedronauck
667
120k
How to Think Like a Performance Engineer
Avatar for Harry Roberts csswizardry
24
1.7k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
68
11k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
Avatar for Addy Osmani addyosmani
6
690
Building Applications with DynamoDB
Avatar for Matt Wood mza
95
6.4k
Building a Modern Day 
E-commerce SEO Strategy
Avatar for Aleyda Solis aleyda
41
7.3k
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
267
13k
Building Flexible Design Systems
Avatar for Yesenia Perez-Cruz yeseniaperezcruz
328
39k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
45
7.3k

Transcript

  1. Escape From New York Tom J Nowell

  2. Validation Sanitisation Escaping

  3. Validation: Is this what it claims to be?

  4. Sanitisation: Lets clean up this input

  5. Escaping: Making output safe

  6. WordPress.com VIP VIP Wrangler - @tarendai

  7. '; DROP TABLE votes'

  8. Search Results For: <?php echo $_GET[‘s’]; ?>

  9. Search Results For: <?php echo $_GET [‘s’]; ?>

  10. <b>Test</b>

  11. <b>Test</b>

  12. <script>alert(“hey”);</script>

  13. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  14. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  15. How to Escape

  16. Sanitize early Escape Late Escape Often

  17. No Data is Safe

  18. <script src='//peniscorp.com/topkek.js'> </script>

  19. Escape Everything..?

  20. echo $var; echo esc_html( $var );

  21. class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”

  22. href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”

  23. wp_kses & wp_kses_post

  24. echo apply_filters( ‘the_content’ wp_kses_post( $content ) );

  25. tomjn.com/escaping

  26. WordPress.com VIP VIP Wrangler - @tarendai

  27. automattic.com/work-with-us/vip-wrangler/

  28. Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com