Tag Info

Hot answers tagged


SVG can contain JavaScript. JavaScript can be used to hijack cookies or do other questionable actions. It can even be "hidden" in namespaces: <html xmlns:ø="http://www.w3.org/1999/xhtml"> <ø:script src="//0x.lv/" /> </html> source It is very hard to filter that out during the upload, so it is just not allowed by default.


In a general sense, any well maintained platform can be used to to create a website with good security. It has to be noted that you will never build a website which is completely secured against hacking and spamming, no matter which platform you use and no matter what genius or pro you are. Hackers evolve faster that the security of a specific piece of code ...


Nothing is 100% secure, so plan for the worst: Assume that your site will be hacked one beautiful day and even totally deleted. Consider therefore recovery plans with: offsite backups for your database and uploaded files, offsite version control repositories for your code (themes and plugins). Decrease the risk by using: up-to-date "trusted" ...


Allowing user to control code is explicitly unsafe operation. As you note the purpose of sanitization is pretty much to not let user slip in anything executable and/or with malicious intent. To "sanitize" executable code you would need programmatic understanding of it (code parser) and criteria engine to distinguish what is safe and what is not. For such ...

Only top voted, non community-wiki answers of a minimum length are eligible