http://qs321.pair.com?node_id=11112508


in reply to Re^12: Making Perl Monks a better place for newbies (and others)
in thread Making Perl Monks a better place for newbies (and others)

I'm not sure I understand how storing user input in the database creates a security issue. If it's code that could run, someone would have to grab that node and .. execute it. The Everything2 engine just stores the user input, then regurgitates it when a node is displayed. The content is never executed by the engine, or by the browser.

Do you have a proof of concept node that exploits this?

Alex / talexb / Toronto

Thanks PJ. We owe you so much. Groklaw -- RIP -- 2003 to 2013.