Try it
What the server made of it
... would run in the next visitor's browser. That is the whole of cross-site scripting, and one builtin is the whole of the defence. */ $name = icpp_trim(icpp_getparam("name")); $amount = icpp_getparam("amount"); $years = icpp_getparam("years"); $n = icpp_atoi($years); $total = 0; $year = 0; $bal = 0; if (icpp_strlen($name) == 0) { iprint("Nothing submitted yet. Fill the form above and press the button — ", "the address bar will show what was sent.
"); } else { iprint("Hello, ", icpp_html_escape($name), ". ", "Your name is ", icpp_strlen($name), " characters long.
"); if ($n > 0) { $bal = icpp_atoi($amount); iprint("Saving ", icpp_html_escape($amount), " a year for ", $n, " years, with nothing added for interest:
"); iprint("| year | paid in |
|---|---|
| ", $year, " | USD ", $total, " |
What arrived
Those are the server's own words for this request. ", "A POST body arrives the same way, in POST_DATA.
"); ?>The rule worth taking away
Escape on the way out, every time, with
icpp_html_escape. A value that came from a visitor is not text
until it has been escaped — it is markup waiting to happen, and the page
above would be a cross-site scripting hole without that one call.