Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Escape From New York

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Tom J Nowell Tom J Nowell
November 01, 2015
Technology
830
0

Escape From New York

A talk on escaping and security in WordPress and PHP

Avatar for Tom J Nowell

Tom J Nowell

November 01, 2015

More Decks by Tom J Nowell

See All by Tom J Nowell
Using Blocks Outside The Editor
Avatar for Tom J Nowell tarendai
0
1.2k
Composer_and_WordPress__1_.pdf
Avatar for Tom J Nowell tarendai
0
98
REST APIs for Absolute Beginners
Avatar for Tom J Nowell tarendai
0
1k
VVV 2
Avatar for Tom J Nowell tarendai
0
910
WordCamp Europe 2016 - Handling Anxiety
Avatar for Tom J Nowell tarendai
1
600
WP The Right Way
Avatar for Tom J Nowell tarendai
0
1.1k
Code Deodorant 2014
Avatar for Tom J Nowell tarendai
1
830
Adv WP CLI
Avatar for Tom J Nowell tarendai
0
790
WP CLI
Avatar for Tom J Nowell tarendai
0
760

Other Decks in Technology

See All in Technology
Genie Code ワークショップ 応用編 / Genie-Code-Workshop-advanced
Avatar for Databricks Japan databricksjapan
PRO
0
310
AI活用の現在地、 ちゃんと見えてますか？/XPfest-2026
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
0
130
AIで開発は速くなったのに、なぜ現場は楽にならないのか 〜あなたの組織のボトルネックを突き止めるワークショップ〜
Avatar for Kazuto Kusama jacopen
1
250
Kiro Crewしか勝たん！？
Avatar for Kazuki Miura miu_crescent
PRO
0
170
Azure Cost Management の FOCUS コストデータを迷わず読むための“3つの軸”
Avatar for Tetsuya Odashima tetsuyaooooo
0
140
データエンジニアの困りごとをDevinと一緒に解消する
Avatar for 10xinc 10xinc
2
790
V8コントリビュート超入門
Avatar for Riya Amemiya riyaamemiya
0
130
Instana&Bob トラブルシュートハンズオン
Avatar for 山崎政憲 mayamasaki68
0
110
[DroidKaigi 2026] Making UI specifications visible: Android UI development in the AI agent era supported by Compose Screenshot Testing and galleries
Avatar for syarihu syarihu
0
530
設計の世代交代を乗り越える、14年続くAndroidアプリの開発戦略
Avatar for SansanTech sansantech
PRO
1
120
20260906 「AWS運用入門」著者が教える、運用業務への生成AI活用入門
Avatar for Masaru Ogura masaruogura
0
220
DINO-EdgeQuery:Edge-First Polygon Decoding for Building Footprint Extraction from Satellite Imagery
Avatar for Yuji Kobayashi lehupa
0
140

Featured

See All Featured
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
33
2.1k
The Anti-SEO Checklist Checklist. Pubcon Cyber Week
Avatar for Ryan Jones ryanjones
0
230
Claude Code のすすめ
Avatar for schroneko schroneko
67
230k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
348
41k
Navigating Algorithm Shifts & AI Overviews - #SMXNext
Avatar for Aleyda Solis aleyda
1
1.6k
KATA
Avatar for Megan Lloyd mclloyd
PRO
35
15k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
Avatar for Chris Coyier chriscoyier
508
140k
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.8k
Six Lessons from altMBA
Avatar for Skipper Chong Warson skipperchong
29
4.5k
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
7.2k
Money Talks: Using Revenue to Get Sh*t Done
Avatar for Nikki Halliwell nikkihalliwell
0
490
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
128
18k

Transcript

  1. Escape From New York Tom J Nowell

  2. Validation Sanitisation Escaping

  3. Validation: Is this what it claims to be?

  4. Sanitisation: Lets clean up this input

  5. Escaping: Making output safe

  6. WordPress.com VIP VIP Wrangler - @tarendai

  7. '; DROP TABLE votes'

  8. Search Results For: <?php echo $_GET[‘s’]; ?>

  9. Search Results For: <?php echo $_GET [‘s’]; ?>

  10. <b>Test</b>

  11. <b>Test</b>

  12. <script>alert(“hey”);</script>

  13. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  14. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  15. How to Escape

  16. Sanitize early Escape Late Escape Often

  17. No Data is Safe

  18. <script src='//peniscorp.com/topkek.js'> </script>

  19. Escape Everything..?

  20. echo $var; echo esc_html( $var );

  21. class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”

  22. href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”

  23. wp_kses & wp_kses_post

  24. echo apply_filters( ‘the_content’ wp_kses_post( $content ) );

  25. tomjn.com/escaping

  26. WordPress.com VIP VIP Wrangler - @tarendai

  27. automattic.com/work-with-us/vip-wrangler/

  28. Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com