mardi 2 décembre 2014

Is this PHP code XSS proof?



Is the following PHP code XSS proof?



<?php

$site = $_GET["url"];

echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), $site)."'>Site</a>";

?>




Aucun commentaire:

Enregistrer un commentaire