04-16-2017, 01:16 PM
Actually, I double checked this. The problem with using Input::get there is that it would strip out all your formatting and punctuation. You'll noticed that the data is sanitized as it's displayed on the profile.php instead...
$usbio = html_entity_decode($thatUser->bio);
The XSS vulnerability should be taken care of by the token check done in the validation on line 41 unless you're seeing something I'm not.
I could definitely be missing something here. Let me know what you think.
$usbio = html_entity_decode($thatUser->bio);
The XSS vulnerability should be taken care of by the token check done in the validation on line 41 unless you're seeing something I'm not.
I could definitely be missing something here. Let me know what you think.