4
4

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

Smarty3でnl2brしつつXSSを避ける書き方

Posted at

Smarty3で改行を含むユーザ入力テキストを、画面に出すときは<br>で改行して出してあげたい、そんな場合にnl2brnofilerを使うといいのですが、普通の書き方をするとXSSの脆弱性になりえます。

XSSできてしまう書き方

{$xss_string|nl2br nofiler}

XSSできない書き方

{{$xss_string}|nl2br nofiler}

闇コードっぽい・・・

4
4
1

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
4
4

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?