A developer is reviewing the following transaction logs from a web application: Username: John Doe Street name: Main St. Street number: alert(`test') Which of the following code snippets should the developer implement given the above transaction logs?

A. if ($input != strcmp($var1, "<>")) {die();}

CompTIA

CAS-003 · Question #492

A developer is reviewing the following transaction logs from a web application: Username: John Doe Street name: Main St. Street number: <script>alert(`test')</alert> Which of the following code…

The correct answer is C. $input=strip_tags(trim($_POST[`var1'])). It is important to notice that this function (strip_tags), in real life, is not the most adequate to prevent XSS attacks, as seen in PHP manual: “Warning: This function should not be used to try to prevent XSS attacks. Use more appropriate functions like htmlspecialchars() or…

Technical Integration of Enterprise Security

Question

A developer is reviewing the following transaction logs from a web application:

Username: John Doe Street name: Main St. Street number: <script>alert(`test')</alert> Which of the following code snippets should the developer implement given the above transaction logs?

Options

Aif ($input != strcmp($var1, "<>")) {die();}
B<form name ="form1" action="/submit.php" onsubmit="return validate()" action=POST>
C$input=strip_tags(trim($_POST[`var1']));

How the community answered

(24 responses)

A
13% (3)
B
8% (2)
C
79% (19)

Explanation

It is important to notice that this function (strip_tags), in real life, is not the most adequate to prevent XSS attacks, as seen in PHP manual: “Warning: This function should not be used to try to prevent XSS attacks. Use more appropriate functions like htmlspecialchars() or other means depending on the context of the output.”.

Topics

#XSS prevention#input sanitization#secure coding#PHP security

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice