#27
May 04, 2007

Cross Site Scripting

Another common security issue is cross site scripting. In this episode you will see why it is so important to escape any HTML a user may submit.
Tags: security views
Download (19.4 MB, 5:50)
alternative download for iPod & Apple TV (9.3 MB, 5:50)
<%=h comment.content %>
CGI::escapeHTML(...)

RSS Feed for Episode Comments 13 comments

1. Xilo32 May 04, 2007 at 00:28

Thanks for another great screencast tutorial!

Keep up the great work!


2. InMan May 04, 2007 at 00:48

Thanks. I missed this security hole in many places :).


3. eTrueke May 04, 2007 at 02:39

Thanks again!


4. Slaptijack May 04, 2007 at 05:31

Good topic, Ryan. Cross-site scripting is such a common problem and really needs plenty of attention.


5. Ryan Bates May 04, 2007 at 07:30

Please let me know if you are unable to transfer the iPod version to your iPod/Apple TV. I may have got the compression settings incorrect or something.


6. David Parker May 04, 2007 at 08:17

Ryan, I haven't yet tried the download for iPod option, but I was just curious: what's the difference between that version and the regular one? Is it just more compressed?


7. Ryan Bates May 04, 2007 at 08:56

Good question. It's 640x480 instead of 800x600 and the compression doesn't look as nice, so if you don't need to play it back on an iPod/Apple TV it's definitely better to stick with the higher quality version.


8. David Parker May 04, 2007 at 12:05

Thanks Ryan. I'll probably start downloading the iPod versions though... that way I can take the casts with me on trips (Sadly, I don't have a laptop yet). As much as I like the higher quality, I find no reason to download the videos twice (and I might as well save you a little bandwidth). Thanks and keep up the good work!


9. Sergio de la Garza May 04, 2007 at 16:58

Thanks Ryan for these excelent screencasts.

Keep it up

congrats from México.


10. Ryan Bates May 04, 2007 at 20:43

For those interested, the iPod format should be working now. Sorry about the incompatable file format.


11. Terrence May 04, 2007 at 23:19

Hey Ryan,
I was JUST about to whine about the iPod version. :) Thanks for another great tute and for reading my mind!


12. peanut May 05, 2007 at 01:18

Very useful issue!


13. Andrew Parker May 09, 2007 at 00:09

I find the ipod versions hard to read because they're too blurry (the normal versions are fantastic, incredibly clear!).
I suppose that's because the resolution has been reduced, but is it also because of higher compression? h264 should be able to do clear video, is it possible to turn up the bitrate?

Anyway, these railscasts are very useful, keep up the great work!


14. albemuth Oct 31, 2007 at 11:26

<script>alert('Hi!')</script> :D


15. Snailrails Feb 04, 2008 at 06:22

Hey, I wrote a quick informative tutorial about XSS on http://www.snailrails.com/2008/1/cross-site-scripting.

Check it out for some more information.


16. Ryan Dec 21, 2008 at 22:26

I know this is an old cast, but I just wanted to point everyone towards a great little plugin I found after watching this.

http://github.com/emk/safe_erb/tree/master

it raises an exception anytime content is displayed to the screen without being escaped with "h". Helped me find a few vulnerabilities in my current project.


17. Kostyuha Feb 17, 2010 at 13:12

I suppose that's because the resolution has been reduced, but is it also because of higher...Is it just more compressed?&&


18. spam Jul 06, 2010 at 01:41

This is all very new to me and this article really opened my eyes.Thanks for sharing with us your wisdom.


19. free card sharing Jul 06, 2010 at 01:41

nice post thank you.


20. card sharing Jul 06, 2010 at 01:42

güzel post teşekkürler :)


22. logo designs Aug 08, 2010 at 23:48

Thanks alot, i have bookmarked you.


23. free directory list Aug 11, 2010 at 22:17

good one site luv that stuff


24. cheap air jordans Aug 19, 2010 at 00:15

Thanks alot, i have bookmarked you. For those interested, the iPod format should be working now. Sorry about the incompatable file format.


25. hurda Aug 20, 2010 at 06:37

I think type of site that is useful in sharing information and it is important to shar.Web proliferation of new developments in the field of design and entrepreneurial spirit of people who have very beautiful and pleasing to be professional.Site concept and sharing are quality thank you.


26. Buz Aug 23, 2010 at 08:22

possibility of sharing and social solidarity at a level just fine thank you


27. Logar Aug 24, 2010 at 01:13

How to speed up internet technology? Thank you..


28. Perde Aug 25, 2010 at 01:17

Your site is very useful in terms of cultural exchange.Thank you.


29. konteyner Aug 26, 2010 at 00:42

a significant share of your site as people think.Thanks you


30. louis vuitton shoes Aug 26, 2010 at 21:14

Thanks for sharing your article. I really enjoyed it. I put a link to my site to here so other people can read it. My readers have about the same interets


31. palet Aug 26, 2010 at 23:32

Very useful in terms of sharing people. Thank you.


32. snow boots Aug 31, 2010 at 01:54

I may have got the compression settings incorrect or something.


33. louis vuitton sunglasses Sep 01, 2010 at 21:22

I feel like I’m often looking for interesting things to read about a variety of subjects, but I manage to include your blog among my reads every day because you have interesting entries that I look forward to. Here’s hoping there’s a lot more great material coming!

Add your comment:

(SKIP THIS ONE)

(required)

(not shown)


(use pastie or gist for code)

sponsored by:
if you want to help:
required:
Get Quicktime Player
Give Back to Open Source