Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Escape From New York

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Tom J Nowell Tom J Nowell
November 01, 2015
Technology
800
0

Escape From New York

A talk on escaping and security in WordPress and PHP

Avatar for Tom J Nowell

Tom J Nowell

November 01, 2015

More Decks by Tom J Nowell

See All by Tom J Nowell
Using Blocks Outside The Editor
Avatar for Tom J Nowell tarendai
0
1.2k
Composer_and_WordPress__1_.pdf
Avatar for Tom J Nowell tarendai
0
96
REST APIs for Absolute Beginners
Avatar for Tom J Nowell tarendai
0
1k
VVV 2
Avatar for Tom J Nowell tarendai
0
870
WordCamp Europe 2016 - Handling Anxiety
Avatar for Tom J Nowell tarendai
1
560
WP The Right Way
Avatar for Tom J Nowell tarendai
0
1.1k
Code Deodorant 2014
Avatar for Tom J Nowell tarendai
1
810
Adv WP CLI
Avatar for Tom J Nowell tarendai
0
780
WP CLI
Avatar for Tom J Nowell tarendai
0
740

Other Decks in Technology

See All in Technology
GitHub Copilot運用のリアル ～AI Credit時代にどう向き合うか～
Avatar for takafumi suzuki takafumisu2uk1
0
470
自分が詳しくない領域でAIを使う #プロヒス2026
Avatar for konifar konifar
20
7.8k
はてなのサービス基盤を支える Kubernetes《足腰》
Avatar for masayosu masayoshimaezawa
0
150
iOS アプリの「これって不具合ですか？」を AI に調べてもらう
Avatar for Yuki Miida miichan
0
150
アラート調査向けAIエージェントの本番導入とその後/AI Agents for Alert Investigation: Production Deployment and After
Avatar for SadayoshiTada taddy_919
1
240
AIをフル活用してオンコール機能のプロトタイプを2日で作った話 / Building an AI-Powered On-Call Prototype in Just Two Days
Avatar for Narimichi Takamura nari_ex
0
140
事業会社における 機械学習・推薦システム技術の活用事例と必要な能力 / ml-recsys-in-layerx-wantedly-2026
Avatar for Yuya Matsumura yuya4
0
160
スタートアップにAmazon EKSは早すぎる？ マルチプロダクト戦略を加速する Platform Engineeringの実践 / Is Amazon EKS Too Soon for Startups? Practical Platform Engineering to Accelerate a Multi-Product Strategy
Avatar for elmo elmodev09
1
1.9k
10年間のブログ発信を振り返って見えたWebアプリケーションエンジニアとしての軌跡
Avatar for すてにゃん stefafafan
0
190
AIチャット検索改善の3週間
Avatar for KNOWLEDGE WORK / 株式会社ナレッジワーク kworkdev
PRO
2
190
IaC コードを資産へ：AWS CDK 社内ライブラリと横断展開 / aws-summit-japan-2026
Avatar for k.goto gotok365
10
1.6k
When Platform Engineering Meets GenAI
Avatar for suci sucitw
0
200

Featured

See All Featured
技術選定の審美眼（2025年版） / Understanding the Spiral of Technologies 2025 edition
Avatar for Takuto Wada twada
PRO
118
120k
GitHub's CSS Performance
Avatar for Jon Rohan jonrohan
1033
470k
世界の人気アプリ100個を分析して見えたペイウォール設計の心得
Avatar for Akihiro Kokubo akihiro_kokubo
PRO
72
40k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
96
14k
Done Done
Avatar for chrislema chrislema
186
16k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
Bootstrapping a Software Product
Avatar for Garrett Dimon garrettdimon
PRO
307
120k
Pawsitive SEO: Lessons from My Dog (and Many Mistakes) on Thriving as a Consultant in the Age of AI
Avatar for David Carrasco davidcarrasco
0
170
Test your architecture with Archunit
Avatar for Yoan thirion
1
2.3k
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
3.1k
Context Engineering - Making Every Token Count
Avatar for Addy Osmani addyosmani
9
980
Navigating Weather and Climate Data
Avatar for Ryan Abernathey rabernat
0
240

Transcript

  1. Escape From New York Tom J Nowell

  2. Validation Sanitisation Escaping

  3. Validation: Is this what it claims to be?

  4. Sanitisation: Lets clean up this input

  5. Escaping: Making output safe

  6. WordPress.com VIP VIP Wrangler - @tarendai

  7. '; DROP TABLE votes'

  8. Search Results For: <?php echo $_GET[‘s’]; ?>

  9. Search Results For: <?php echo $_GET [‘s’]; ?>

  10. <b>Test</b>

  11. <b>Test</b>

  12. <script>alert(“hey”);</script>

  13. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  14. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  15. How to Escape

  16. Sanitize early Escape Late Escape Often

  17. No Data is Safe

  18. <script src='//peniscorp.com/topkek.js'> </script>

  19. Escape Everything..?

  20. echo $var; echo esc_html( $var );

  21. class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”

  22. href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”

  23. wp_kses & wp_kses_post

  24. echo apply_filters( ‘the_content’ wp_kses_post( $content ) );

  25. tomjn.com/escaping

  26. WordPress.com VIP VIP Wrangler - @tarendai

  27. automattic.com/work-with-us/vip-wrangler/

  28. Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com