diff options
| author | Andrey Andreev <narf@devilix.net> | 2017-03-24 10:04:53 +0100 |
|---|---|---|
| committer | Andrey Andreev <narf@devilix.net> | 2017-03-24 10:04:53 +0100 |
| commit | c7c0bdf4f7af7c4e71b073ee87ddb792087bdfac (patch) | |
| tree | 5cfb825e1e0d67f30d4c8a91428cd52eb580695a /user_guide_src/source/libraries/security.rst | |
| parent | 1d9aaee34ea77fdb68d79d7add37f26dd2649c00 (diff) | |
| parent | 0eb38af2eaf1127b9b82261b7ec3bf4d4b847318 (diff) | |
Merge branch '3.1-stable' into develop
Conflicts resolved:
system/core/CodeIgniter.php
system/core/Common.php
system/core/Input.php
system/helpers/cookie_helper.php
tests/codeigniter/helpers/html_helper_test.php
user_guide_src/source/changelog.rst
user_guide_src/source/conf.py
user_guide_src/source/installation/downloads.rst
user_guide_src/source/installation/upgrading.rst
user_guide_src/source/libraries/input.rst
Diffstat (limited to 'user_guide_src/source/libraries/security.rst')
| -rw-r--r-- | user_guide_src/source/libraries/security.rst | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/user_guide_src/source/libraries/security.rst b/user_guide_src/source/libraries/security.rst index f7604ef00..fc5cba19d 100644 --- a/user_guide_src/source/libraries/security.rst +++ b/user_guide_src/source/libraries/security.rst @@ -40,6 +40,9 @@ browser may attempt to execute. // file failed the XSS test } +.. important:: If you want to filter HTML attribute values, use + :php:func:`html_escape()` instead! + ********************************* Cross-site request forgery (CSRF) ********************************* @@ -101,7 +104,11 @@ Class Reference :rtype: mixed Tries to remove XSS exploits from the input data and returns the cleaned string. - If the optional second parameter is set to true, it will return boolean TRUE if the image is safe to use and FALSE if malicious data was detected in it. + If the optional second parameter is set to true, it will return boolean TRUE if + the image is safe to use and FALSE if malicious data was detected in it. + + .. important:: This method is not suitable for filtering HTML attribute vales! + Use :php:func:`html_escape()` for that instead. .. php:method:: sanitize_filename($str[, $relative_path = FALSE]) @@ -162,4 +169,4 @@ Class Reference Used for generating CSRF and XSS tokens. .. note:: The output is NOT guaranteed to be cryptographically secure, - just the best attempt at that.
\ No newline at end of file + just the best attempt at that. |