How to prevent XSS attack - cakephp 4

Need Help
1

Hi,
how to stop XXS attack? Codeignitor has ESC at the front end. Is a similar variable available with CakePHP?

thank you

Jeewaka

2

Use h function in view

Hello <?= h($user->name)

or Text::autoParagraph

3

Dear @raul338

Thank you so much

Normally attack comes in input field like below;

<input type="password" class="form-control" id="exampleInputPassword1" placeholder="Password">

So how to stop hacker to stop writing a code in the input field and database details?

if you can explain regard to input field much appreciated.

thank you

Jeewaka

4

If you follow the book on converting request data into entities, you are safe of SQL injections.

Then use the methods I posted before to convert posible javascript code to escaped strings.

5

Thank you @raul338

As a beginner was expecting easy method like the use of esc() in the field.

thank you

will try

6

I have to chip in here - not the use of technology but your understanding. Point 1, you cannot trust the client. No matter how you wrap your webpage in protecting JavaScript it’s input fields can be compromised. In fact, a decent hacker wouldn’t even bother load your webpage and form up, they just directly sent the GET or POST commands to your webserver.

Now you can protect the input fields to some extend by using Cake’s form protector. It calculates a hash figure based on the input fields it generates, then puts that into a hidden field, so on post it then compares the parameters returned with the hash of the parameters to ensure nothing was introduced. This doesn’t protect the values in the fields, just ensures that what was asked for was received.

Then another layer of protection is CSRF. That will prevent hackers from spamming your webpage with spoofed input fields as they won’t have the legitimate request token. (I mean, they can still do it with a request, grabbing the token, and passing it back - but it stops casual interference.)

Once the data has come back into your PHP handler you can run it through any number of PHP sanitizing & filtering functions which are available.

Then, as raul338 said, if you even need to display on the webpage info they have entered wrap it with the h() function which prevents PHP & JavaScript etc protection.

7

Thank you.
sorry for the late reply.

8

Data sanitization is worst you can do, and it may cases it results in malformed data being saved in db which sometimes may not be possible to reverse.

To prevent XSS you have to encode output just before displaying it to the user (this can be done simply by using h() function).

BTW Cake ORM will mitigate most of simple sql injections but not of them and in fact some of features implemented in ORM can make injections easier to perform, and not only form fields can be used to inject malicious payload - cookies and http headers are used for that as well.

9

thank you so much for replying and information.

So is the CakePHP framework not secure?

10

That was not my point. Developers made cake as secure as possible.
Its all up to you as documentation states:

https://book.cakephp.org/4/en/orm/query-builder.html#sql-injection-prevention

Exactly same rule applies to ANY framework on the market.