Professional Search Engine Optimization (Seo). Developer’s Guide to SEO

Ajax software Free javascripts
↑

Main Page

Modify

comments.php

by adding a third comment that contains an unaccepted

onerror

attribute. You’re also including a reference to

sanitize.inc.php

<?php

// load the nofollow library

require_once ‘include/nofollow.inc.php’;

// load the sanitize library

require_once ‘include/sanitize.inc.php’;

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.1//EN”

“http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd”>

<html>

<head>

<title>: Comments</title>

</head>

<body>

<h1>Old comments:</h1>

<?php

// display first comment

echo noFollowLinks(‘<p>Hello! Take a look at <a href=”http://too.much.spam”>cool

link</a>!</p>’);

// display second comment

echo noFollowLinks(‘<p>We\‘ve just released our new product, <a

href=”http://seophp.example.com/Products/SEO-Toolbox-C6/Link-Juice-P31.html”>Link

Juice</a>.</p>’);

// display third comment

$inHTML = ‘<p>Sanitizing <img src=”INVALID-IMAGE”‘ .

‘onerror=”location.href=\‘http://too.much.spam/\‘“>!</p>’;

echo $inHTML;

</body>

</html>

Note you haven’t sanitized the input

$inHTML

yet. Take a look at what happens without the

sanitizing function applied. Loading

http://seophp.example.com/comments.php

should

redirect you automatically to

http://too.much.spam/

, as shown in Figure 8-7. This address

doesn’t exist, obviously, but the exercise proved how easy is to implement such redirects if the

data isn’t escaped.

Now, try to take out the sanitizing function by updating

comments.php

. Find this line:

echo $inHTML;

and replace it with this line:

echo sanitizeHTML($inHTML);

Now load

http://seophp.example.com/comments.php

once again. Fortunately, this time

you will not be redirected to the spam site, as it happened earlier. You should get the output

shown in Figure 8-8.

186

Chapter 8: Black Hat SEO

c08.qxd:c08 10:59 186

Ajax software Free javascripts
→