Why not login to Qiita and try out its useful features?

We'll deliver articles that match you.

You can read useful information later.

4
4

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

Smarty3でnl2brしつつXSSを避ける書き方

Posted at

Smarty3で改行を含むユーザ入力テキストを、画面に出すときは<br>で改行して出してあげたい、そんな場合にnl2brnofilerを使うといいのですが、普通の書き方をするとXSSの脆弱性になりえます。

XSSできてしまう書き方

{$xss_string|nl2br nofiler}

XSSできない書き方

{{$xss_string}|nl2br nofiler}

闇コードっぽい・・・

4
4
1

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up

Qiita Conference 2025 will be held!: 4/23(wed) - 4/25(Fri)

Qiita Conference is the largest tech conference in Qiita!

Keynote Speaker

ymrl、Masanobu Naruse, Takeshi Kano, Junichi Ito, uhyo, Hiroshi Tokumaru, MinoDriven, Minorun, Hiroyuki Sakuraba, tenntenn, drken, konifar

View event details
4
4

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?