[WEB SECURITY] Re: [Full-disclosure] noise about full-width encoding bypass?

[ascii <ascii@xxxxxxxxxxxx>]

Brian Eaton wrote:
> To summarize what I've heard from various sources: I am missing
> something important. =)  Both PHP and ASP.NET will decode these
> characters into their ASCII equivalents.

(AFAIK)

Only ASP.NET/IIS decodes that automatically.

PHP *can* do that as like JSP and probably others but that has
to happen explicitly in the application code or on an other layer.

Regards,
Francesco `ascii` Ongaro
http://www.ush.it/


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]