Fix Cross-Site Scripting in CodeIgnitor App

Hi there I am interested in your project. I have experience in fixing security issues in php sites. thank you

Hi There! I have more than 8-year experience in this field. Would you please share more details about the project? I am really interested to work with you for long. Best Regards, Santosh

Hi, First of all set $config['global_xss_filtering'] = FALSE; You don't need or want this on all the time. This config setting is officially deprecated. It will likely disapear in the future. Second, if you are using version 3.0.x then remove ‘xss_clean’ from your validation rules. It is not on the officially supported list of form validation rules. The place where you can employ XSS filtering is when using the Input Class to fetch data from POST, GET, COOKIE or SERVER. Most of the input methods have a second param that enables running the data through xss_clean(). Example: $this->input->post('some_data', TRUE); Will get the value of $_POST['some_data']and run it through xss_clean(). If the second param is FALSE (or omitted) xss_clean() will not be used.