Support Forums

j890432m + · 06-25-2008, 03:40 PM

Can malicious users execute php code if html are allowed in fields or uploads.

Example 1. Allow html tags in description field

example 2: creating an extra field of type upload and file extension html. Since some servers, like mine is set to execute html as php, if someone inserts php into the uploaded file, will the php execute, or is there a way to prevent php and javascript etc. executions in such a file in order to limit it to pure html in order to have a nice and flexible display of text but without the danger.

**Eric Barnes** + · 06-25-2008, 04:34 PM

Yes they could and it is recommended to only allow txt,pdf,doc,etc. Although I have also seen viruses in doc files.

Anything uploaded that can be parsed can be used against your site.

06-25-2008, 03:40 PM	#1
j890432m + Junior Member Join Date: May 2008 Posts: 14 Rep Power: 11	Can malicious user execute php code if html are allowed in fields or uploads Can malicious users execute php code if html are allowed in fields or uploads. Example 1. Allow html tags in description field example 2: creating an extra field of type upload and file extension html. Since some servers, like mine is set to execute html as php, if someone inserts php into the uploaded file, will the php execute, or is there a way to prevent php and javascript etc. executions in such a file in order to limit it to pure html in order to have a nice and flexible display of text but without the danger.

06-25-2008, 04:34 PM	#2
Eric Barnes + 68 Classifieds Staff Join Date: Mar 2006 Location: Belmont, NC Posts: 5,497 Rep Power: 132	Yes they could and it is recommended to only allow txt,pdf,doc,etc. Although I have also seen viruses in doc files. Anything uploaded that can be parsed can be used against your site. __________________ Eric Barnes 68 Classifieds Developer Customer Area \| Issue Tracker \| Documentation \| 68C Mods \| 68 @ Twitter \| My Modules

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Support Forums

Can malicious user execute php code if html are allowed in fields or uploads

This topic is resolved.