What is the best way to protect against Log Injection attacks in PHP ? Of course, we should sanitize input, but the question is how, and what has to be sanitized ?
For example, if I am logging something that can come from the user, first step would be to make sure that what he enters, do not cause some problems in the OS, or strange behaviours of the application. Then, if we display log entries somewhere in the application, we need to make sure that XSS and similar attacks are not possible.
I am looking at PHP sanitize filters as a possible solution, but I do not really know what should I filter out. What characters can be dangerous ?
from How to protect against Log Injection attacks in PHP?
0 komentar:
Posting Komentar