Re: [PHP] losing session data with cross-site scripting

2005-09-21 Thread Chris Shiflett
Steve Lefevre wrote: Can you explain what cross-site scripting is, then? This article is quite old (a few years), and there are a few inconsistencies I would like to correct, but I think it does a better job of explaining than I can in an email: http://shiflett.org/articles/foiling-cross-si

Re: [PHP] losing session data with cross-site scripting

2005-09-21 Thread Steve Lefevre
Chris Shiflett wrote: Steve Lefevre wrote: In this case, a user's session is stagnant for the duration of their trip to the other server. I'm guessing that users are typically only there for a brief moment, but this is something to keep in mind. Is there a way that some of your users might s

Re: [PHP] losing session data with cross-site scripting

2005-09-21 Thread Chris Shiflett
Steve Lefevre wrote: No, it's not. They're totally separate machines at different ISPs. In this case, a user's session is stagnant for the duration of their trip to the other server. I'm guessing that users are typically only there for a brief moment, but this is something to keep in mind. Is

Re: [PHP] losing session data with cross-site scripting

2005-09-21 Thread Steve Lefevre
Chris Shiflett wrote: Steve Lefevre wrote: I have a php site on a production server. The production server doesn't have the spell libraries, and rather than migrate the site, we setup spell checking functions on the development site, and shuttled the users back and forth with specially crafted

Re: [PHP] losing session data with cross-site scripting

2005-09-21 Thread Chris Shiflett
Steve Lefevre wrote: I have a php site on a production server. The production server doesn't have the spell libraries, and rather than migrate the site, we setup spell checking functions on the development site, and shuttled the users back and forth with specially crafted get links and forms. T

Re: [PHP] losing session data with cross-site scripting

2005-09-20 Thread Jasper Bryant-Greene
Steve Lefevre wrote: I have a php site on a production server. The production server doesn't have the spell libraries, and rather than migrate the site, we setup spell checking functions on the development site, and shuttled the users back and forth with specially crafted get links and forms.

[PHP] losing session data with cross-site scripting

2005-09-20 Thread Steve Lefevre
Hey folks - I have a php site on a production server. The production server doesn't have the spell libraries, and rather than migrate the site, we setup spell checking functions on the development site, and shuttled the users back and forth with specially crafted get links and forms. The POS