Comments on: How to migrate to PDO without it hurting… much http://www.greebo.net/2010/01/02/how-to-migrate-to-pdo-without-it-hurting-much/ mostly useless crap from me Sat, 24 Jul 2010 11:56:43 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: Benoit http://www.greebo.net/2010/01/02/how-to-migrate-to-pdo-without-it-hurting-much/comment-page-1/#comment-21323 Benoit Tue, 05 Jan 2010 12:42:41 +0000 http://www.greebo.net/?p=602#comment-21323 Great post, and great aim to rewrite your app. As of sanityzing output, once we had to do it for a really old CMS app, started in 99 with ASP/access then migrated to PHP in 2003. In 2008 we had to integarate the front office part to support IE7/8 The HTML contents in database got a low risks of injection (no public comments or such), but it was so ugly generated by poor WYSIWYG editor, has MsWord metadata in it.As a consequence IE7 was crashing some times (really) and other browser mostly stop rendering content seeing as much of MS Word crappy css and proprietary tags. We used HTML purifier to clean up this, but after some testing it was too slow to run on the fly. While refactoring the app we made a data sanitization script to clean up the markup stored in DB, and we adjusted the back office app to do the same before saving data. This way we can trutly pull HTML content from database. All this to say, HTMLPurifier helped us cleaning up empty or invalid HTML tags, but it can also (and apparently does it very well) filter XSS attempts and various bunch of malicious code. Great post, and great aim to rewrite your app.

As of sanityzing output, once we had to do it for a really old CMS app, started in 99 with ASP/access then migrated to PHP in 2003. In 2008 we had to integarate the front office part to support IE7/8

The HTML contents in database got a low risks of injection (no public comments or such), but it was so ugly generated by poor WYSIWYG editor, has MsWord metadata in it.As a consequence IE7 was crashing some times (really) and other browser mostly stop rendering content seeing as much of MS Word crappy css and proprietary tags.

We used HTML purifier to clean up this, but after some testing it was too slow to run on the fly.
While refactoring the app we made a data sanitization script to clean up the markup stored in DB, and we adjusted the back office app to do the same before saving data.

This way we can trutly pull HTML content from database.

All this to say, HTMLPurifier helped us cleaning up empty or invalid HTML tags, but it can also (and apparently does it very well) filter XSS attempts and various bunch of malicious code.

]]>