CSS, PHP and Security

[Ben Holness]

Hi,

I am thinking about opening a web site which will allow people to register
and then have direct access to a stylesheet in order to brand their page.

When a user saves their stylesheet, the system will reject it if it
includes any of the '<', '>' or '?' characters. I know this restricts some
CSS, but that's fine for my purposes.

Is there anything else I should check for? How vulnerable does having this
option leave me?

Cheers,

Ben

[Carl Vondrick]

Re: CSS, PHP and Security

Ben Holness wrote:[color=blue]
> Is there anything else I should check for?[/color]
You can put JavaScript in CSS. Example:

background-image : url('javascript :alert(msg);');
[color=blue]
> How vulnerable does having this option leave me?[/color]
If you do it properly, you should not have any problems. My suggestion is
to implement Smarty in this case, as then you give your visitors COMPLETE
control.

--
Carl Vondrick
Web-Enginner

https://www.CarlSoft.net

To contact me, please use my website.