Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I have developed a site that allows the users to embed widgets into their profile.
These widgets allow html and support anything from youtube embed codes (iframe) to Google Analytics code (JavaScript).
I have recently learned about hackers using iframes and JavaScript to exploit site logins and ftp access.
Is there some sort of php solution that I can integrate into my site to avoid these types of hacks while still allowing users to embed HTML widgets into their profile?
No.
There is no way that you can mechanically distinguish between all “good” JavaScript (e.g, Google Analytics) and “bad” JavaScript. (Without either whitelisting scripts that you approve of, which will inevitably not allow everything that users want, or blacklisting scripts that are inappropriate, which will inevitably be a game of whack-a-mole.)
You will need to stop allowing users to inject arbitrary HTML into your site.