How to secured UPLOADER from XSS ??..

[ewanz]

Sanity the badw0rds like <script> n the 0ther html tags in y0ur sh0utb0x..

[izer88]

how to secure the wml with this method?

i mean, at the shoutbox

[CreativityKills]

Thats Crap. ASCII does nothing to help out.

[sm4rtgl0b3]

ADDING INFO:
to avoid xss attack you can also use a string replace like replacing bad or Suspicious characters into its ascii code.,
create a bbcode function for input and output.,
input function will be change that bad character to its uncomplete ascii like & #47;
and output function will put & #47; together...

So if user input something like <
Simply change it t0 its ascii code :D h0pe you got it

Added after 4 minutes:

ADDING INFO:
to avoid xss attack, post method sqli.
you can also use a string replace like replacing bad or Suspicious characters into its ascii code.,
create a bbcode function for input and output.,
input function will be change that bad character to its uncomplete ascii like & #47;
and output function will put & #47; together...

So if user input something like <
Simply change it t0 its ascii code :D h0pe you got it

[leadiztah]

thx WAPXTECH and MUNIGOD -up-

[rukiya]

Lots of buyers here! lol

[MuniGod]

@munigod can i hire you to secure every holes of my uloki forum? How much is your labor? I can only pay via paypal.

Sorry, but I work only for themselves. ;)

[Jervy]

@munigod can i hire you to secure every holes of my uloki forum? How much is your labor? I can only pay via paypal.

[MuniGod]

How to secure from XSS (Cross-site scripting)?
Use: strip_tags() or htmlspecialchars().
Cross-site scripting - Wikipedia, the free encyclopedia

How to secure from UTF-7 XSS?
Use: header('Content-type: text/html; charset=UTF-8');, <meta http-equiv="content-type" content="text/html; charset=utf-8" />
UTF-7 XSS Cheat Sheet

How to secure from Cookie/session hijacking?
Use: when user loging save his IP, and every refresh check user IP with saved, if doesn't match delete session.
Session fixation - Wikipedia, the free encyclopedia
Session hijacking - Wikipedia, the free encyclopedia
Session poisoning - Wikipedia, the free encyclopedia
Cross-site cooking - Wikipedia, the free encyclopedia

How to secure from CSRF (Cross-site request forgery)?
Use: generate every refresh unique token, and check it at every refresh, like http://www.example.com/example?bla=1...oken=Jdf1S19cQ
Cross-site request forgery - Wikipedia, the free encyclopedia

How to secure from Code injection: Directory traversal/Remote file inclusion?
Use: only these symbolas [A-Za-z0-9_-], check if it is your file like:
$modules = array('forum', 'chat');
if(in_array($_GET['module'], $modules))
echo 'OK';
else
exit('Module doesn\'t exist!');
Code injection - Wikipedia, the free encyclopedia
Directory traversal - Wikipedia, the free encyclopedia
Remote file inclusion - Wikipedia, the free encyclopedia

How to secure from Malicious file upload?
Use: check every file MIME type, if you use not yours programs like: WYSIWYG editor, remove demo pages.

How to secure from HTTP Redirect?
Use: after header('Location: ...'); use exit(); or die();

How to secure from SQL injection?
Use: mysql_real_escape_string();

[Jervy]

@creativitykills is the script ab0ve the best way to prevent sql injecti0n or xss? Or there are other ways? And can it secure an uloki forum?Thanx 4 ur opini0n.G0dbless

[CreativityKills]

Btw using htmlspecial chars in an attempt to block xss is like trying to block sql injection with magic quotes.

[Jervy]

Thanx a lot wapxtech such a great help for us

[wapxtech]

thx for that., i already secured my HTML tags.. lke what you are posting.. but the hacker use the CSS to install that XSS.. i have CSS gallery on my wapsite.. so how can i prevent from XSS uploader?.

html and java is not working in css.. uhhhm.. maybe you have been hacked using shell.. secure your uploader prevent to upload php files.. or add this in htaccess

php_flag engine Off

if your server is running on phpsuexec mode, php_flag will return to 500 internal server error.. then instead of php_flag engine Off use this code bellow in your htaccess

<Files .htaccessl>
Order Deny,Allow
Deny from all
</Files>
RemoveType .pl .cgi .php .php3 .php4 .php5 .xml .phtml .phtm .html .htm .wml .shtm .shtml .nth
RemoveHandler .pl .cgi .php .php3 .php4 .php5 .xml .phtml .phtm .html .htm .wml .shtm .shtml .nth

[leadiztah]

thx for that., i already secured my HTML tags.. lke what you are posting.. but the hacker use the CSS to install that XSS.. i have CSS gallery on my wapsite.. so how can i prevent from XSS uploader?.

[wapxtech]

they are using php script in xss, linking php in images, adding it in a script, etc. so you should prevent linking php files in images..

like this

[img ]http://host.com/path/session_stealer.php[/img ]

simply use str_replace,

for example the bbcode is

$text = preg_replace("/\[img\=(.*?)\](.*?)\[\/img\]/is","<img src=\"$1\"></img>",$text);

you can add str_replace on it like this..

$text = str_replace("php"," ",$text);
$text = preg_replace("/\[img\=(.*?)\](.*?)\[\/img\]/is","<img src=\"$1\"></img>",$text);

if he post an image like this

[img ]http://host.com/path/session_stealer.php[/img ]

it will be displayed as

<img src="http://host.com/path/session_stealer.">

and it will not work.. :D

another hint, hacker is adding their exploit in avatars .. its same as bbcode.. you can use str_replace