Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Escape From New York
Search
Tom J Nowell
November 01, 2015
Technology
0
690
Escape From New York
A talk on escaping and security in WordPress and PHP
Tom J Nowell
November 01, 2015
Tweet
Share
More Decks by Tom J Nowell
See All by Tom J Nowell
Using Blocks Outside The Editor
tarendai
0
940
Composer_and_WordPress__1_.pdf
tarendai
0
71
REST APIs for Absolute Beginners
tarendai
0
950
VVV 2
tarendai
0
740
WordCamp Europe 2016 - Handling Anxiety
tarendai
1
450
WP The Right Way
tarendai
0
1k
Code Deodorant 2014
tarendai
1
700
Adv WP CLI
tarendai
0
680
WP CLI
tarendai
0
640
Other Decks in Technology
See All in Technology
Lufthansa ®️ USA Contact Numbers: Complete 2025 Support Guide
lufthanahelpsupport
0
240
ゼロからはじめる採用広報
yutadayo
4
1k
スタックチャン家庭用アシスタントへの道
kanekoh
0
110
american aa airlines®️ USA Contact Numbers: Complete 2025 Support Guide
aaguide
0
500
CDK Toolkit Libraryにおけるテストの考え方
smt7174
1
450
VGGT: Visual Geometry Grounded Transformer
peisuke
1
620
事例で学ぶ!B2B SaaSにおけるSREの実践例/SRE for B2B SaaS: A Real-World Case Study
bitkey
1
340
Four Keysから始める信頼性の改善 - SRE NEXT 2025
ozakikota
0
210
アクセスピークを制するオートスケール再設計: 障害を乗り越えKEDAで実現したリソース管理の最適化
myamashii
1
330
関数型プログラミングで 「脳がバグる」を乗り越える
manabeai
2
220
サイバーエージェントグループのSRE10年の歩みとAI時代の生存戦略
shotatsuge
4
830
SREの次のキャリアの道しるべ 〜SREがマネジメントレイヤーに挑戦して、 気づいたこととTips〜
coconala_engineer
1
1k
Featured
See All Featured
Testing 201, or: Great Expectations
jmmastey
43
7.6k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
10
970
Documentation Writing (for coders)
carmenintech
72
4.9k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
44
2.4k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
281
13k
Build your cross-platform service in a week with App Engine
jlugia
231
18k
Connecting the Dots Between Site Speed, User Experience & Your Business [WebExpo 2025]
tammyeverts
7
330
Fireside Chat
paigeccino
37
3.5k
Rebuilding a faster, lazier Slack
samanthasiow
83
9.1k
Done Done
chrislema
184
16k
Optimizing for Happiness
mojombo
379
70k
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
126
53k
Transcript
Escape From New York Tom J Nowell
Validation Sanitisation Escaping
Validation: Is this what it claims to be?
Sanitisation: Lets clean up this input
Escaping: Making output safe
WordPress.com VIP VIP Wrangler - @tarendai
'; DROP TABLE votes'
Search Results For: <?php echo $_GET[‘s’]; ?>
Search Results For: <?php echo $_GET [‘s’]; ?>
<b>Test</b>
<b>Test</b>
<script>alert(“hey”);</script>
Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>
Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>
How to Escape
Sanitize early Escape Late Escape Often
No Data is Safe
<script src='//peniscorp.com/topkek.js'> </script>
Escape Everything..?
echo $var; echo esc_html( $var );
class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”
href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”
wp_kses & wp_kses_post
echo apply_filters( ‘the_content’ wp_kses_post( $content ) );
tomjn.com/escaping
WordPress.com VIP VIP Wrangler - @tarendai
automattic.com/work-with-us/vip-wrangler/
Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com