Today, I saw a funny comment on a website:
<script> alert('0wn3d by X - X') </script>
<meta HTTP-EQUIV=Refresh CONTENT="0; URL=Some URL">
In case you don’t know about these types of attacks, an attacker will write this comment on a blog (or any sort of web application) and if the application doesn’t escape it before displaying it, this code will display an alert box and then redirects your visitors to whatever the URL is right away.
So again, if I visit this page, I see the alert box and will be redirected to another page on the Internet.
To prevent this, you will have to escape all user generated content before displaying them on your pages, in PHP:
function html_escape($str) {
return htmlentities($str, ENT_QUOTES, 'utf-8');
}
In Python:
import cgi
# ...
def escape_html(value)
return cgi.escape(value, True)
These types of attacks are called Cross-Site Scripting or XSS:
http://en.wikipedia.org/wiki/Cross-site_scripting
Good Luck
Web App Security: XSS Attacks
Last night I needed a C++ IDE right away; I had Eclipse for writing Python and knew that it had a C/C++ extension called CDT.
So I installed this CDT and I also had MingW and Cygwin installed but the only project I could compile was the sample Hello World project.
Whenever I made an empty project, Eclipse responded with “Launch Failed. Binary Not Found.”.
I read a few articles online but no luck and I didn’t want to spend a lot of time on it so I decided to try Netbeans.
After I installed Netbeans, BAM, it detected Cygwin and compiled everything right away!!!
That is what I wanted, I wanted an IDE that I can just make a CPP file and compile without any extra steps and Netbeans did that for me!
I’m not a C++ or Eclipse guru but I’m a normal user who is searching for simplicity and doesn’t have a lot of time to waste on things like this.
Update:
Read the comments bellow for some possible solutions…
Eclipse “Launch Failed. Binary Not Found.” and Netbeans
I’m sure I’m not the only one who thought about this but I think one of the things that holds me back from using it more is the fact that C++ doesn’t have a higher level standard library.
A while back I was thinking of writing a thread library that works both on Windows (my desktop) and Linux (my server) and I gave up and used Python for the project.
The problem is that Python is not fast enough for parts of my project and I have to use either C or C++ but I will go with C++ because of it’s Map and Vector containers etc.
I’m not sure why they didn’t implement all the good stuff that are in Python standard library in C++ but I think it’s really time.
I also found this great set of tools that might be in the next C++ standard library:
http://www.boost.org/
This is exactly what C++ needs; I don’t see why cross platform libraries for threading, database access etc. shouldn’t be included in C++ standard library.
It has a lot of great features; objects, operator overloading, many kinds of containers, templates, namespaces and it’s very fast.
C++ needs a higher level standard library
Happy new year everyone and I hope this will be a great new year full of great things for you.
Did you know the new year was delayed for 1 second?
Apparently earth is slowing down turning around it’s axis
Happy New Year