Probably none.

In my webapps i usually do away with URL parameters completly. URL parameters often enough open the door for some simple XSS attacks (email manipulated URL...).

Of course, depending on your webserver, this is not an option. *But* - and here is the important part - when you use dynamic URL parameters, they should not contain form input. These parameters should only contain parameters generated by your backend - which you then lookup against ID's stored in whatever you use for data storage.

Form input (which you POST, not GET, according to RFC2616) is harder to validate. This depends strongly on the data you expect and how you gonna store and display it later. The key here is to whitelist (allow) characters, not blacklist (deny) them. It's easier to expand the list after checking a character is save, then it is to fix a never-ending list of new "open holes".

If you use a database (which i strongly recommend), use the quote() function of DBI or prepared() statements with placeholders. This at least should you save from exploits like SQL injection.

I'm also taking a wild guess here on my own experience and say that probably about 10-50% of your input can be validated by the database by using foreign keys against static tables or by using ENUM's. Your mileage may vary, but at some point or the other, you have to trust at least your own staff to enter correct data anyway.

One last personal note: While it's certainly nice to have support for Unicode and therefore many typed languages: This kind of support may bind quite a large number of resources on your part and may lead to all kinds of weird behaviour on badly implemented clients. Unicode in itself may pose a security risk even when correctly implemented: An example are unicode domain names; depending on the font, the user might not be able to distinguish between the correct link to his online banking website and a fake one a scammer set up.

Don't use '#ff0000':
use Acme::AutoColor; my $redcolor = RED();
All colors subject to change without notice.

In reply to Re^2: Strip utf-8 dangerous url chars by cavac
in thread Strip utf-8 dangerous url chars by AlfaProject

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.