Zugzwangle Posted August 9, 2010 Share Posted August 9, 2010 Hi. I have made profile pages available for users.. How do I turn off <?php ?> for those pages? I would like javascript enabled however. All suggestions are welcome!! Thanks Quote Link to comment Share on other sites More sharing options...
RussellReal Posted August 9, 2010 Share Posted August 9, 2010 htmlEntities() the output should fix everything Quote Link to comment Share on other sites More sharing options...
Zugzwangle Posted August 9, 2010 Author Share Posted August 9, 2010 I want to allow javascript oh!!! Any other ideas? Quote Link to comment Share on other sites More sharing options...
RussellReal Posted August 9, 2010 Share Posted August 9, 2010 oh I seeeeeeeeeeeee yeahhhhhhhhhhhh .... ... .. . oh right.. javascript.. lemme ask you.. do you eval() this code at all? do you put it into a file then include this page? because if you for instance.. echo a string which contains "<?php echo 'hi'; ?>" (well technically it wouldn't work because ?> would kill it, but I'm assuming you're pulling it from a DB so the technically doesn't affect you now does it?) it will basically echo it as a string.. not evaluate it so you posting here technically is a waste of time.. if you aren't building a file then including it.. and another side note, if you look around I'm the only one here who posted to help you so its probably in your best interest to not get all sarcastic and stuff on a public board, where you are the one here asking for help, and I am the good guy trying to help you .. Have a good morning in any event Quote Link to comment Share on other sites More sharing options...
Zugzwangle Posted August 9, 2010 Author Share Posted August 9, 2010 Oh, I didn't mean to be sarcastic at all!! I was being genuine.. I'll explain. Users 'html' input, is saved to a SQL database, and then recalled. I presumed that if the user saved <?php // content // ?> and it was recalled by php, it would execute - so that is wrong yes? Quote Link to comment Share on other sites More sharing options...
Wolphie Posted August 9, 2010 Share Posted August 9, 2010 Oh, I didn't mean to be sarcastic at all!! I was being genuine.. I'll explain. Users 'html' input, is saved to a SQL database, and then recalled. I presumed that if the user saved <?php // content // ?> and it was recalled by php, it would execute - so that is wrong yes? Yes, that is wrong. Unless it's given as a parameter to eval() then that code will not be executed, but instead be treated as a string (unlike JavaScript on the other hand which is interpreted by the browser) Quote Link to comment Share on other sites More sharing options...
onlyican Posted August 9, 2010 Share Posted August 9, 2010 and it is dangerous to allow end user to add JS to your website, we spend a lot of time stopping JS includes. JS can give then an open window to ur server. Quote Link to comment Share on other sites More sharing options...
Zugzwangle Posted August 9, 2010 Author Share Posted August 9, 2010 May I say a big thank you to all who posted.. and thanks to RussellReal too - it worked!! (even though you called me sarcastic) Quote Link to comment Share on other sites More sharing options...
RussellReal Posted August 9, 2010 Share Posted August 9, 2010 and it is dangerous to allow end user to add JS to your website, we spend a lot of time stopping JS includes. JS can give then an open window to ur server. allowing js doesn't give you a window to your server anywhere other than pages that are requestable from the outside anyway .. JS never reaches to the backend.. the only thing you need to look out for is server-side javascript.. what it DOES do is give them access to cookies on other users' computers, and that is a huge security flaw.. but saying it is a window to your server is a very big exaggeration Quote Link to comment Share on other sites More sharing options...
onlyican Posted August 10, 2010 Share Posted August 10, 2010 Hey I never said it was a ground floor Patio Window, Its more likely a 40th floor cat size window but still a window. Still dont like allowing users to actually run JS from my site. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.