Web Security Revisted
Update: I fixed a bug in the code below. It should work properly now.
I wrote a couple of articles about a year ago describing an idea I had for implementing security into a CakePHP app to insure that cross site scripting attacks don’t get though. Just recently I’ve been working on it again for a new app, slightly changing my approach. Since I’ve never shared all of my code on how I’ve fully implemented and configured my set up with the HTML Purifier, I’m going to do that now. Of course some of the code I’ve already shared, but this will be all of it together.
I originally had everything set up as a component. What I want to do is clean everything up before I actually save it to the database. And I mean everything. Any data that can be altered from a form should be run through some sort of clean up process, to ensure it’s security. The problem with having it set up in a component is that in Cake that can only be accessed from a controller, right? So what I really want is for this clean up process to happen in the background for any data that is saved, without me having to write any extra code in a controller. That’s when I decided to take my component and move into my AppModel. I suppose this could be done as a behavior as well, but I’m not real familiar with writing those.
