Wedge

I think it's important that some element of that is continued to be done, but how far do you go with it? At what point is it acceptable to trade off performance for security?

On the flip side, there are things like topic subjects, which aren't resanitised on display, what's in the DB is assumed to be safe.

It reattributes old posts to a new user, e.g. new account after deletion, but it doesn't do topic ownership at the same time.

You know something's wrong when they're accepting mods on the mod site that are bug-fix mods. I only wish I were kidding.

You can say that about a lot of things, though. It's almost the same argument against something like Microsoft Word: just because you might only use 2% of its features, that sounds like an argument for stripping out the rest - until you realise that everyone else uses a different 2% of its features.

I wonder if preparsecode's changing everything into br tags is a holdover from YaBB where everything was in flat files. (I don't know how it was stored, but it seems feasible to me)

That's one of the things we can do something about. We've expressly set ourselves on the path of having an importer rather than just 'upgrading' the existing tables - aside from the fact it lets people run them both side by side to experiment, it also means we can do manipulations along the way like fix any of these things we decide to resolve.

Depends what you mean by sanitise. htmlspecialchars both ends strikes me as a bad idea, for example.

Well, the methodology I was referring to was that all mods using the database should use $smcFunc's functions, and should be using the proper parameterisation, or the proper insert method made available that deals with escaping etc for you.

were still deferred through some "well, it might cause regressions" mantra.

We use jQuery in Wedge. Not just because it means we get to minimise the code to be sent to users (since the admin can pick a CDN copy of jQuery), but the time we spent writing JS is shorter, and I suspect less time is also spent in debugging. Plus a lot of users do add stuff that makes use of jQuery, so having it in the core means plugins won't try each adding it and falling over each other.

Does this make sense? I've been wondering, wouldn't mysql_real_escape be enough while appending to DB?

I never used mysql_real_escape, I always used prepared statement because I find them a lot easier.

I always used htmlspecialchars for data that goes in a html attribute, I rarely use them for anything else.

Also the data that comes out of the database tends to be dirty, it like to keep the back slashes, so clean it with stripslashes() and always before htmlspecialchars().

SMF (and Wedge)'s specific brand of content encoding going into the DB, where bbcode is concerned at least, is slightly odd, and one day I'll figure out exactly why it was done the way it was (remove newlines, expressly inject br tags into the stored content, after htmlspecialchars has been run)

@CJ Jackson: I'd rather not be trying to sanitise on output, I'd rather sanitise it when capturing it so that if something screwball tries to dump the contents of the DB, it's still going to be safe because there isn't anything dirty in the DB.

At least with SMF, mods are vetted and generally have had oddities weeded out

I believe I've already run everything through pngquant. I do it systematically for new files and keep a 32 bit copy in the other/images folder as well. ^_^

I dont automate it because png8 sometimes has awful results in ie6 btw.

Forcing users to use GET and POST, rather than an ambiguous source is a nice step, though honestly I'd love to see a proper taint detection method such as in Perl, where you explicitly can't do anything to input without some kind of sanity check first.

I don't know which off the top of my head, but if it works how I think it works, it'll be GET - because what it can do is inject a <script> tag into the DOM for the browser to fetch the contents dynamically - and it'll be JSON when it comes in, presumably.

....I wouldn't call the POS IDEs for PHP proper IDE's either. Then again, the only thing I think Microsoft ever did right was Visual Studio so....:/
/quote]

Indeed.  I use Phalanger myself for PHP and it works great.  I bet it could be hacked relatively easily into supporting a JSON-like array syntax.

-[Unknown]