How to secured UPLOADER from XSS ??..

[Jervy]

How about the bbcode like the image bbcode? What's the script to prevent xss fr0m it?

[wapxtech]

XSS stands for Cross Site Scripting.. meaning to say, XSS hacking method does not need any uploader to hack a site... technically speaking it steals admin's session to hack a site using some script like session/cookie logger.. if you want to secure your site against XSS, disable java/html where user can use it .. you can use htmlspecialchars() function to secure your site in XSS hacking.. for example.. user will post like this

<script>alert(document.cookie);</script>

and will be displayed at shoutbox, for example.. your shoutbox variable is $shouts

instead of this

<?
$shouts = mysql_fetch_array(mysql_query("SELECT shout FROM prefix_tablename ORDER BY time DESC LIMIT 1"));

echo "Shouter: $shouts";
?>

you can do like this code below to be safe in XSS hacking

<?
$shouts = mysql_fetch_array(mysql_query("SELECT shout FROM prefix_tablename ORDER BY time DESC LIMIT 1"));

echo "Shouter: ".htmlspecialchars($shouts)."";
?>

[leadiztah]

Pls help me... how to secured my uploader from XSS?...

usually XSS get the session id from the url of your browser..