Question about HTML and security

ferrethouse2004 · Post by **ferrethouse2004** » Mon Aug 14, 2006 12:18 am

I implemented a mod to allow youtube videos but it didn't work. So I've enabled HTML on my forums and added embed, param, object as allowed tags. Is this a bad move?

Techie-Micheal · Post by **Techie-Micheal** » Mon Aug 14, 2006 12:26 am

ferrethouse2004 wrote: I implemented a mod to allow youtube videos but it didn't work. So I've enabled HTML on my forums and added embed, param, object as allowed tags. Is this a bad move?

Unfortunately yes. Potential XSS (though the phpBB parsing engine tries its best to prevent that), and various other problems can arise.

comperr · Post by **comperr** » Mon Aug 14, 2006 12:33 am

Also, I can embed certain things that would mess up your forum...I won't, but I can

advertisements