Member Avatar for phoenix254

Hello,
I would like to ask you that which is good library(angularjs jquery react blabla or simple js)/method/technique to get safe input value from users(to prevent csrf and xss or any other malicious) ? which is more safe document.getElementById();or$('#id/.class');
and what is bind data? explain me this in poor people language,please my english is weak.

Edited by phoenix254
  • 3 Contributors
  • 6 Replies
  • 279 Views
  • 16 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

To answer : data binding simply keeps a JavaScript value and a piece of the UI in sync (change one, the other updates). Frameworks like Angular make that automatic and convenient, but binding is a convenience — not a security boundary. and pointed toward the right direction; here are practical, concrete steps that close the gaps those posts left.

Always treat client input as untrusted and enforce rules on the server. Steps that matter in order of priority: whitelist acceptable values (type, length, allowed characters), use parameterized queries or ORM placeholders for any database access, canonicalize inputs before validation, and perform context-appropriate output encoding when rendering (HTML text nodes, attributes, JavaScript contexts all need different escaping). If user-supplied HTML must be allowed, use a proven sanitizer rather than homemade replacements.

Simple server-side HTML-escape example (Node):

function escapeHtml(s) {
  return s.replace(/[&<>"']/g, function(ch) {
    return {'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[ch];
  });
}

This is for text nodes — use proper encoding for attributes, CSS or JS contexts.

CSRF and chat specifics: require a per-request or per-session CSRF token (or rely on SameSite cookie policy in modern browsers) and always serve session cookies as HttpOnly and Secure over HTTPS. For chat, prefer JSON APIs or authenticated WebSockets; accept plain text messages (escape before rendering) and only allow sanitized HTML where strictly needed. Short checklist: server-side validation, parameterized DB access, context-aware output encoding, vetted HTML sanitizers when needed, CSRF tokens/SameSite cookies, and HTTPS. This combination gives concrete protection beyond the high-level points already raised by and .

Recommended Answers

All 6 Replies

Member Avatar for Member #120589

I don't think anything on the client will prevent CSRF or XSS - they're usually due to vulnerabilities on the server. Most of the libs you mention are built on js, so they are not any "better" than plain js, just a bit more convenient maybe.

To what are you referring with bind data?

Member Avatar for phoenix254

i didnt know what is angular so i was googling about that then i found it(bind data). i tried too search this but i dont understand very well. so i asked this question with above question. please tell me what is data bind ?and which method is best to use for chat get post in ajax ?

Edited by phoenix254
Member Avatar for Member #120589

This is extending the original question somewhat. I think you need to ask a more specific question with regard to "data binding" with "angularjs" in a new thread as this thread title gives no clue as to the discussion you wish to have.

Member Avatar for Taywin

As diafol said, there is NO WAY to prevent CSRF and/or XSS from input values. The rule of thumb, NEVER trust any input from user. You must SANITIZE the value if security is concerned. Either way (document.getElementById() or $('#id/.class'); is the same.

When you are talking about bind data, what are you binding the data to? The meaning of the word is simple, to connect something with another thing. A simple example would be to bind a HTML DOM element to a variable -- var elem = document.getElementById('anId'). However, it depends whether you want to keep the elem alive or let it live within a scope.

Edited by Taywin
Member Avatar for phoenix254

any tip to sanitize the value ?

Member Avatar for Member #120589

Sanitizing will happen on the server. You provide no info about what yur using or doing on the server, so can't see how we can help.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.