How To Restrict Xss In Yii?

Yii 1.1 General Discussion
1

How to Restrict XSS in YII?

One of the xss tool giving high warning to following url

yii/testdrive/user/login?ref=javascript:alert(1);

Can any one suggest me how to fix?

2

Looks like false positive since there’s no ref parameter in default application.

3

Yes. Purposefully we have done as mention below in the controller

if (isset($_GET[‘ref’])) {

$ref = $_GET[‘ref’];

$this->redirect($ref);

}

Do u have suggestion, how to fix

4

so what is the problem ?? you can sanitize $_GET before assigning

5

Thanks guys. got an idea to fix the issue.