Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Escape From New York

Avatar for Tom J Nowell Tom J Nowell
November 01, 2015
Technology
0
760

Escape From New York

A talk on escaping and security in WordPress and PHP

Avatar for Tom J Nowell

Tom J Nowell

November 01, 2015
Tweet

More Decks by Tom J Nowell

See All by Tom J Nowell
Using Blocks Outside The Editor
Avatar for Tom J Nowell tarendai
0
1.1k
Composer_and_WordPress__1_.pdf
Avatar for Tom J Nowell tarendai
0
95
REST APIs for Absolute Beginners
Avatar for Tom J Nowell tarendai
0
1k
VVV 2
Avatar for Tom J Nowell tarendai
0
820
WordCamp Europe 2016 - Handling Anxiety
Avatar for Tom J Nowell tarendai
1
520
WP The Right Way
Avatar for Tom J Nowell tarendai
0
1.1k
Code Deodorant 2014
Avatar for Tom J Nowell tarendai
1
770
Adv WP CLI
Avatar for Tom J Nowell tarendai
0
750
WP CLI
Avatar for Tom J Nowell tarendai
0
710

Other Decks in Technology

See All in Technology
夢の無限スパゲッティ製造機 #phperkaigi
Avatar for hideki kinjyo o0h
PRO
0
290
TinyTroupeで人狼ゲームやってみた！
Avatar for ueponx ueponx
0
130
大規模ECサイトのあるバッチのパフォーマンスを改善するために僕たちのチームがしてきたこと
Avatar for panda_program panda_program
1
310
実践 Datadog MCP Server
Avatar for 株式会社ヌーラボ nulabinc
PRO
2
250
Phase05_ClaudeCode入門
Avatar for overflow ,Inc overflowinc
0
280
テストプロセスにおけるAI活用 ：人間とAIの共存
Avatar for hacomono Inc. hacomono
PRO
0
110
GCASアップデート（202601-202603）
Avatar for 高橋広和 techniczna
0
240
スピンアウト講座06_認証系（API-OAuth-MCP）入門
Avatar for overflow ,Inc overflowinc
0
160
頼れる Agentic AI を支える Datadog のオブザーバビリティ / Powering Reliable Agentic AI with Datadog Observability
Avatar for Kento Kimura aoto
PRO
0
240
20年以上続く PHP 大規模プロダクトを Kubernetes へ ── クラウド基盤刷新プロジェクトの4年間
Avatar for Yuichi Sugiyama oogfranz
PRO
0
140
【Λ（らむだ）】最近のアプデ情報 / RPALT20260318
Avatar for Λ lambda
0
120
イベントで大活躍する電子ペーパー名札を作る（その２） 〜 M5PaperとM5PaperS3 〜 / IoTLT @ JLCPCB オープンハードカンファレンス
Avatar for you（@youtoy） you
PRO
0
140

Featured

See All Featured
Navigating Algorithm Shifts & AI Overviews - #SMXNext
Avatar for Aleyda Solis aleyda
1
1.2k
Efficient Content Optimization with Google Search Console & Apps Script
Avatar for Katarina Dahlin katarinadahlin
PRO
1
420
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
57
14k
End of SEO as We Know It (SMX Advanced Version)
Avatar for Michael King ipullrank
3
4.1k
AI Search: Implications for SEO and How to Move Forward - #ShenzhenSEOConference
Avatar for Aleyda Solis aleyda
1
1.2k
How To Speak Unicorn (iThemes Webinar)
Avatar for Michelle Schulp Hunt marktimemedia
1
410
Building a Modern Day 
E-commerce SEO Strategy
Avatar for Aleyda Solis aleyda
45
9k
Measuring Dark Social's Impact On Conversion and Attribution
Avatar for Stephen Akadiri stephenakadiri
1
160
Being A Developer After 40
Avatar for Adrian Kosmaczewski akosma
91
590k
Put a Button on it: Removing Barriers to Going Fast.
Avatar for kastner kastner
60
4.2k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
82
6.2k
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
33
1.6k

Transcript

  1. Escape From New York Tom J Nowell

  2. Validation Sanitisation Escaping

  3. Validation: Is this what it claims to be?

  4. Sanitisation: Lets clean up this input

  5. Escaping: Making output safe

  6. WordPress.com VIP VIP Wrangler - @tarendai

  7. '; DROP TABLE votes'

  8. Search Results For: <?php echo $_GET[‘s’]; ?>

  9. Search Results For: <?php echo $_GET [‘s’]; ?>

  10. <b>Test</b>

  11. <b>Test</b>

  12. <script>alert(“hey”);</script>

  13. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  14. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  15. How to Escape

  16. Sanitize early Escape Late Escape Often

  17. No Data is Safe

  18. <script src='//peniscorp.com/topkek.js'> </script>

  19. Escape Everything..?

  20. echo $var; echo esc_html( $var );

  21. class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”

  22. href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”

  23. wp_kses & wp_kses_post

  24. echo apply_filters( ‘the_content’ wp_kses_post( $content ) );

  25. tomjn.com/escaping

  26. WordPress.com VIP VIP Wrangler - @tarendai

  27. automattic.com/work-with-us/vip-wrangler/

  28. Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com