Code injection vulnerability with $ _POST vars?

Question

I wonder if I have a vulnerability with respect to the code below in the fwrite file?

foreach($_POST as $key=>$val) {
    fwrite($fh, "\nPOST variable named " . $key . " has the value " . $val);
}

Should I somehow sanitize the values before they are written to the log file?

UPDATE fh - log file handler

+5

Andrei Jul 13 '12 at 8:35

3 answers

, $fh. $fh HTML, . , - .

htmlspecialchars(..) HTML.

UPDATE

, :

+3

SuperSaiyan 13 . '12 8:38

XSS (Cross-Site Scripting) ( HTML, ). , - .

+2

nhahtdh Jul 13 '12 at 8:40

Jon · Accepted Answer · 2012-07-13T08:37:06+0000

There is no vulnerability if the log file is processed by its consumers as plain text (which should always be).

HTML-, (, , ). "" , HTML htmlspecialchars, , .