What's a good method for stripping HTML from our site search? I've found that it's possible to inject HTML directly into our page like this:
https://website.co.uk?keywords="<svg/onload%3Dconfirm(//)>
The page source then looks like this:
ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It only takes a minute to sign up.
Sign up to join this communityI posted the same question here and got a fix. We were using {get:keywords}
when we should have been using {low_search_keywords}
. That tag sanitises HTML for you. Hope that helps someone...