Viewing: TrimVars - Prevent XSS Flaws

cf_trimvars is a quick solution to trim and 'html escaped' structure variables, such as form and url variables.

By using this custom tag, not only you won't have to trim each and every variables manually, but also protect your code from cross site scripting (XSS) attack, cause you can set all URL and FORM variables to be escaped before sent to your application.

All of this can be done by simply adding 1 line in your Application.cfm.
Save your time trimming tons of URL and FORM variables, and prevent your whole application from cross site scripting vulnerabilities.

Learn more about XSS vulnerability: http://www.aspectsecurity.com/topten/xss.html

***Is this tag for you?
1. Count how many trim function you have on your application.
2. Check your application, especially URL and FORM variables from XSS attack.
3. You'll have the answer!

*** Requirements:
ColdFusion 5, MX and up

*** Usage:
exclude = "list of variables not to be trimmed"
dontescape = "list of variables not to be html escaped">

*** Examples:
1. Trim and escape all URL and FORM variables. Just put below line in your application.cfm


2. Trim and escape all URL and FORM variables, except form.UploadFile as it contains uploaded file.
Put below line in your application.cfm


3. Trim and escape all URL and FORM variables, except form.UploadFile cause it contains uploaded file, and HTMLText cause it contains HTML tags.
Put below line in your application.cfm


4. Trim query result.


SELECT PARKNAME, REGION, STATE
FROM Parks