Perhaps around 6 or 7 years ago now I was a member of a very popular question and answer site (like Yahoo answers but more informal). Anyway, part way along they decided to introduce some forum functionality, private messaging, user profiles and of course, basic html formatting options. Clearly somebody hadn't read any tutorials on sanitizing php...
They only allowed three tags. <b> <i> and <u>. One of my favourite pasttimes was hijacking threads by placing malformed html into my posts. Eg: <b>Hello<b/>. This was parsed as being a valid tag due to the presence of the closing slash in the second tag, yet the integrity was not checked, and as such the entire page containing the malformed tag would appear in bold, italics or underlined, whatever I felt like. I called it stylisation terrorism
Anyway, after about a week and a half of literally every thread being hijacked by me, they patched it and sent me a warning not to keep messing about with the html. Of course, that's like telling a hacker "If you log into my account again I'll just change the password ok!"...
A few weeks later, they added the ability to add in images using <img src=""></img>. Bad move. Feeling incredibly annoyed at being 'warned' for pressuring them to fix an obvious bug which could have led to xss attacks, I went one step further.
<img src=""<?php echo The security here stinks! Me and my password are outta here; ?>>
Rather than thread hijack, I just put that code in my signature and left the site, head held high. And that my friends, is why you should never allow HTML tags directly into your source-code.
