Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Escape From New York
Search
Tom J Nowell
November 01, 2015
Technology
0
650
Escape From New York
A talk on escaping and security in WordPress and PHP
Tom J Nowell
November 01, 2015
Tweet
Share
More Decks by Tom J Nowell
See All by Tom J Nowell
Using Blocks Outside The Editor
tarendai
0
810
Composer_and_WordPress__1_.pdf
tarendai
0
67
REST APIs for Absolute Beginners
tarendai
0
850
VVV 2
tarendai
0
650
WordCamp Europe 2016 - Handling Anxiety
tarendai
1
390
WP The Right Way
tarendai
0
990
Code Deodorant 2014
tarendai
1
660
Adv WP CLI
tarendai
0
640
WP CLI
tarendai
0
560
Other Decks in Technology
See All in Technology
【shownet.conf_】ShowNet伝送改めShowNet APN 2024
shownet
PRO
0
380
つよつよリーダーが 抜けたらどうする? 〜ナビタイムのAgile⽀援組織の変遷〜
navitimejapan
PRO
22
13k
スクラム導入の舞台裏:QAエンジニアがスクラムマスターになるまで
bubo1201
0
150
【shownet.conf_】ネットワークテストの最適化と利便性の追求
shownet
PRO
0
290
PREEMPT_RT over the years
ennael
PRO
0
330
それでもやっぱり ExpressRoute が好き!
skmkzyk
0
110
LINEヤフー新卒採用 コーディングテスト解説 アルゴリズム問題編
lycorp_recruit_jp
0
13k
トークナイザー入門
payanotty
2
850
コード✕AIーソフトウェア開発者のための生成AI実践入門~
yuhattor
3
100
【shownet.conf_】コンピューティング資源を統合した分散コンテナ基盤の進化
shownet
PRO
0
350
マーケットプレイス版Oracle WebCenter Content For OCI
oracle4engineer
PRO
2
200
VS CodeでF1〜12キーつかってますか? / Do you use the F1-12 keys in VS Code?
74th
2
280
Featured
See All Featured
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
25
650
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
26
4k
How to Think Like a Performance Engineer
csswizardry
16
1k
Six Lessons from altMBA
skipperchong
26
3.4k
Large-scale JavaScript Application Architecture
addyosmani
509
110k
StorybookのUI Testing Handbookを読んだ
zakiyama
26
5.1k
Making the Leap to Tech Lead
cromwellryan
130
8.8k
How STYLIGHT went responsive
nonsquared
94
5.1k
Stop Working from a Prison Cell
hatefulcrawdad
267
20k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
327
21k
Building Adaptive Systems
keathley
37
2.1k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
131
32k
Transcript
Escape From New York Tom J Nowell
Validation Sanitisation Escaping
Validation: Is this what it claims to be?
Sanitisation: Lets clean up this input
Escaping: Making output safe
WordPress.com VIP VIP Wrangler - @tarendai
'; DROP TABLE votes'
Search Results For: <?php echo $_GET[‘s’]; ?>
Search Results For: <?php echo $_GET [‘s’]; ?>
<b>Test</b>
<b>Test</b>
<script>alert(“hey”);</script>
Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>
Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>
How to Escape
Sanitize early Escape Late Escape Often
No Data is Safe
<script src='//peniscorp.com/topkek.js'> </script>
Escape Everything..?
echo $var; echo esc_html( $var );
class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”
href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”
wp_kses & wp_kses_post
echo apply_filters( ‘the_content’ wp_kses_post( $content ) );
tomjn.com/escaping
WordPress.com VIP VIP Wrangler - @tarendai
automattic.com/work-with-us/vip-wrangler/
Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com