Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Escape From New York

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Tom J Nowell Tom J Nowell
November 01, 2015
Technology
770
0

Escape From New York

A talk on escaping and security in WordPress and PHP

Avatar for Tom J Nowell

Tom J Nowell

November 01, 2015

More Decks by Tom J Nowell

See All by Tom J Nowell
Using Blocks Outside The Editor
Avatar for Tom J Nowell tarendai
0
1.1k
Composer_and_WordPress__1_.pdf
Avatar for Tom J Nowell tarendai
0
95
REST APIs for Absolute Beginners
Avatar for Tom J Nowell tarendai
0
1k
VVV 2
Avatar for Tom J Nowell tarendai
0
820
WordCamp Europe 2016 - Handling Anxiety
Avatar for Tom J Nowell tarendai
1
530
WP The Right Way
Avatar for Tom J Nowell tarendai
0
1.1k
Code Deodorant 2014
Avatar for Tom J Nowell tarendai
1
780
Adv WP CLI
Avatar for Tom J Nowell tarendai
0
750
WP CLI
Avatar for Tom J Nowell tarendai
0
710

Other Decks in Technology

See All in Technology
Oracle AI Database@Google Cloud：サービス概要のご紹介
Avatar for oracle4engineer oracle4engineer
PRO
6
1.3k
推し活エージェント
Avatar for ゆんたん yuntan_t
1
890
OpenClaw初心者向けセミナー / OpenClaw Beginner Seminar
Avatar for hiranofumio cmhiranofumio
0
360
さくらのAI Engineから始める クラウドネイティブ意識
Avatar for Melonps melonps
0
120
ADOTで始めるサーバレスアーキテクチャのオブザーバビリティ
Avatar for Ryotaro Harada alchemy1115
2
260
New CBs New Challenges
Avatar for Yosuke Suzuki ysuzuki
1
160
ふりかえりがなかった職能横断チームにふりかえりを導入してみて学んだこと 〜チームのふりかえりを「みんなで未来を考える場」にするプロローグ設計〜
Avatar for Masahiro Shimokawa masahiro1214shimokawa
0
260
「決め方」の渡し方 / How to hand over the "decision-making process"
Avatar for Pauli pauli
8
1.3k
シン・リスコフの置換原則 〜現代風に考えるSOLIDの原則〜
Avatar for Watanabe Jin jinwatanabe
0
160
Hooks, Filters & Now Context: Why MCPs Are the “Hooks” of the AI Era
Avatar for Miriam Schwab miriamschwab
0
130
英語翻訳を通じて 音声AIエージェント入門してみた
Avatar for ShichijoYuhi shichijoyuhi
0
110
システムは「動く」だけでは 足りない - 非機能要件・分散システム・トレードオフの基礎
Avatar for nwiizo nwiizo
23
6.9k

Featured

See All Featured
The Curious Case for Waylosing
Avatar for Cassini Nazir cassininazir
0
290
Un-Boring Meetings
Avatar for Sebastian Deterding codingconduct
0
260
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
97
6.6k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
Avatar for Morgane Peng morganepeng
133
19k
Chasing Engaging Ingredients in Design
Avatar for Sebastian Deterding codingconduct
0
160
The Invisible Side of Design
Avatar for Vitaly Friedman smashingmag
302
51k
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
370
20k
What Being in a Rock Band Can Teach Us About Real World SEO
Avatar for Ade Holder 427marketing
0
210
How to build a perfect <img>
Avatar for Jono Alderson jonoalderson
1
5.3k
The SEO identity crisis: Don't let AI make you average
Avatar for Varn varn
0
440
[SF Ruby Conf 2025] Rails X
Avatar for Vladimir Dementyev palkan
2
930
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
515
110k

Transcript

  1. Escape From New York Tom J Nowell

  2. Validation Sanitisation Escaping

  3. Validation: Is this what it claims to be?

  4. Sanitisation: Lets clean up this input

  5. Escaping: Making output safe

  6. WordPress.com VIP VIP Wrangler - @tarendai

  7. '; DROP TABLE votes'

  8. Search Results For: <?php echo $_GET[‘s’]; ?>

  9. Search Results For: <?php echo $_GET [‘s’]; ?>

  10. <b>Test</b>

  11. <b>Test</b>

  12. <script>alert(“hey”);</script>

  13. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  14. Search Results For: <?php echo esc_html( $_GET[‘s’] ); ?>

  15. How to Escape

  16. Sanitize early Escape Late Escape Often

  17. No Data is Safe

  18. <script src='//peniscorp.com/topkek.js'> </script>

  19. Escape Everything..?

  20. echo $var; echo esc_html( $var );

  21. class=”<?php echo $css; ?>” class=”<?php echo esc_attr( $css ); ?>”

  22. href=”<?php echo $url; ?>” href=”<?php echo esc_url( $url ); ?>”

  23. wp_kses & wp_kses_post

  24. echo apply_filters( ‘the_content’ wp_kses_post( $content ) );

  25. tomjn.com/escaping

  26. WordPress.com VIP VIP Wrangler - @tarendai

  27. automattic.com/work-with-us/vip-wrangler/

  28. Questions? Tom J Nowell - WordPress.com VIP @tarendai - tomjn.com