diff options
author | Andrey Andreev <narf@devilix.net> | 2015-10-12 16:16:35 +0200 |
---|---|---|
committer | Andrey Andreev <narf@devilix.net> | 2015-10-12 16:16:35 +0200 |
commit | 3013f53c59a5d2550a126b1493cf8262bd62dd53 (patch) | |
tree | 772e9b569a65e8567c366671373a2700c2028445 /user_guide_src/source/libraries/security.rst | |
parent | 30f593bbb3408d0c076f2453818c68a7c5c59248 (diff) | |
parent | 36a055e49b040e6f18be7bce5e010c2a90d2f44f (diff) |
Merge branch '3.0-stable' into develop
Diffstat (limited to 'user_guide_src/source/libraries/security.rst')
-rw-r--r-- | user_guide_src/source/libraries/security.rst | 19 |
1 files changed, 5 insertions, 14 deletions
diff --git a/user_guide_src/source/libraries/security.rst b/user_guide_src/source/libraries/security.rst index 305a8e57c..f7604ef00 100644 --- a/user_guide_src/source/libraries/security.rst +++ b/user_guide_src/source/libraries/security.rst @@ -16,20 +16,11 @@ application, processing input data for security. XSS Filtering ************* -CodeIgniter comes with a Cross Site Scripting Hack prevention filter -which can either run automatically to filter all POST and COOKIE data -that is encountered, or you can run it on a per item basis. By default -it does **not** run globally since it requires a bit of processing -overhead, and since you may not need it in all cases. - -The XSS filter looks for commonly used techniques to trigger Javascript -or other types of code that attempt to hijack cookies or do other -malicious things. If anything disallowed is encountered it is rendered -safe by converting the data to character entities. - -Note: This function should only be used to deal with data upon -submission. It's not something that should be used for general runtime -processing since it requires a fair amount of processing overhead. +CodeIgniter comes with a Cross Site Scripting prevention filter, which +looks for commonly used techniques to trigger JavaScript or other types +of code that attempt to hijack cookies or do other malicious things. +If anything disallowed is encountered it is rendered safe by converting +the data to character entities. To filter data through the XSS filter use the ``xss_clean()`` method:: |