Top all-time · #2477
Chris Shiflett
Personal blog · shiflett.org/blogwebsecurityprogramming
Chris Shiflett's personal blog at shiflett.org covers web, security and programming. Since 2007, 31 different Hacker News readers have linked it 33 times, most often “Addslashes() Versus mysql_real_escape_string(), by Chris Shiflett”. It is still writing: the last post was on 2026-05-27, and you can follow it by feed.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
HN readers cite Chris Shiflett's blog as an early source on web security: XSS, CSRF, addslashes and SQL injection, plus Accept headers and URL design, mostly from 2005 to 2010 posts.
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Chris Shiflett likes making things: products, companies, communities, and the occasional conference.
Most-linked posts?
- Addslashes() Versus mysql_real_escape_string(), by Chris Shiflett3 people · 3 mentions · first linked 2009-05-22
- Foiling Cross-Site Attacks, by Chris Shiflett2 people · 2 mentions · first linked 2013-02-01
- Just You Wait2 people · 2 mentions · first linked 2026-05-21
- /blog/2007/mar/my-amazon-anniversary2 people · 2 mentions · first linked 2009-04-13
- /2 people · 2 mentions · first linked 2011-08-08
What Hacker News says?
Hello. Thanks! This old blog design is showing its age, certainly, but I appreciate the nod to URL Sentences: https://shiflett.org/blog/2010/url-sentences
Comment linking /blog/2010/url-sentences
on “You can't leak users' data if you don't hold it”Submitted JavaScript and URLs as a story · 134 points
HN discussionThis is an old idea that is finally coming to fruition. See a Microsoft paper from 2011 that prominently features cookie isolation [1]. Or a 2012 proposal in Mozilla's bug tracker [2] which resulted in some proof-of-concept code early on, a writeup in 2013 hosted on Github [3]; blogged about independently and contemporaneously by others [4], which hit HN [5]. I've always taken a dim view on cross-domain requests in…
Comment linking /articles/foiling-cross-site-attacks
on “Cross-Site Request Forgery is dead”Submitted The Accept Header as a story · 56 points
HN discussionActually, you should also always indicate the character encoding, for reasons I explain here: http://shiflett.org/blog/2005/dec/google-xss-example
Comment linking /blog/2005/dec/google-xss-example
on “I Like PHP”Submitted Rev="canonical" tags to cure short url problems as a story · 19 points
HN discussionMany years ago, UTF-7 was a viable way in which you could try to exploit Internet Explorer's somewhat questionable default of interpreting a resource as UTF-7 if it finds a UTF-7 character in the first 4096 bytes: http://shiflett.org/blog/2005/googles-xss-vulnerability
Comment linking /blog/2005/googles-xss-vulnerability
on “UTF-7: a ghost from the time before UTF-8”Submitted Hacking Rails (and GitHub) as a story · 18 points
HN discussionA few corrections. IE is not preferring anything in your example. The default quality is 1.0, and since no quality is indicated for any type, they all share the highest preference. Although IE's Accept header is technically useless, it's more likely to be a response to developers incorrectly parsing Accept than the other way around. This post is about sites using primitive string matching to parse Accept, and it's n…
Comment linking /blog/2007/sep/logic
on “The Accept Header”Submitted LeakedIn - Check if you LinkedIn Password is Leaked as a story · 17 points
HN discussionLooks like the same game as the "don't click" twitter button (that everyone clicked anyway) from 2009. That was iframes/css. http://shiflett.org/blog/2009/feb/twitter-dont-click-exploit
Comment linking /blog/2009/feb/twitter-dont-click-exploit
on “It's surprisingly simple to click jack using CSS4”Submitted Indie Web Movement and IndieAuth as a story · 14 points
HN discussionI think what is normal is to let the company know first. And also give them a test they can reproduce with the bug and also a deadline in which you are going to make public the security bug you have done. The deadline is because many companies ignore the problem until is public. This opinion comes from reading this Chris Shifflet's article: http://shiflett.org/blog/2007/mar/my-amazon-anniversary "On this day last ye…
Comment linking /blog/2007/mar/my-amazon-anniversary
on “Ask HN: Found security flaw in site, what should I do?”Submitted Javascript Study Guides as a story · 14 points
HN discussionbash$ diff -u <(curl -s http://leakedin.org) <(curl -s http://leakedln.org) --- /dev/fd/63 2012-06-07 15:31:02.000000000 +0100 +++ /dev/fd/62 2012-06-07 15:31:02.000000000 +0100 @@ -322,6 +322,7 @@ </noscript> <form id="leakedin-check" onsubmit="hashIt()"> <fieldset> + <input type="text" name="uname" id="uname" placeholder="Type your username here" /> <input autocomplete="off" type="text" name="check" id="check" onb…
Comment linking /
on “Leakedln.org: clever parody/critique of leakedIn.org”Submitted Just You Wait as a story · 3 points
HN discussionI totally agree, except the date one. I feel like many people don't take the time to make their URLs look good. I do like when I can go to /2008/06 and see all the posts from June. Here's some more interesting reading on URL design: http://shiflett.org/blog/2008/mar/urls-can-be-beautiful
Comment linking /blog/2008/mar/urls-can-be-beautiful
on “Top 10 Fatal URL Design Mistakes”Submitted Allowing HTML and Preventing XSS (2007) as a story · 3 points
HN discussionI've done this on a couple well-visited client sites and it worked incredibly well. The best part is that it's super easy to add an invisible "email" field to a form and check if it has any content on the backend. By far the best bang for the buck. I'm fairly sure I first learned this trick from Chris Shiflett's blog[1] a few years back, although I can't seem to find the original post. 1: http://shiflett.org/
Comment linking /
on “Different approach to form protection”Submitted Addslashes() Versus mysql_real_escape_string(), by Chris Shiflett as a story · 3 points
HN discussionBlog about website design + blog post about website security = Excellent source of well-intended data that perpetuates PHP code that people think is secure For a better post on securing PHP scripts, see IBM's post at http://www.ibm.com/developerworks/opensource/library/os-php-... or just see http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-re... to understand why anyone recommending addslashes should be ign…
Comment linking /blog/2006/jan/addslashes-versus-mysql-real-escape-string
on “Guidelines to Lock Down Your Website”Submitted PHP Anthem as a story · 3 points
HN discussionaddslashes is NOT an appropriate way to prevent SQL injection attacks. Chris Shiflett explained the addslashes vulnerability years ago: http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-re...
Comment linking /blog/2006/jan/addslashes-versus-mysql-real-escape-string
on “Prevention of SQL injection in PHP”Submitted Just You Wait as a story · 2 points
HN discussionAmazon have had well documented CSRF holes for years: http://shiflett.org/blog/2007/mar/my-amazon-anniversary If this story turns out to be true (seems perfectly likely) maybe they'll finally start taking them seriously and fixing them.
Comment linking /blog/2007/mar/my-amazon-anniversary
on “How to cause moral outrage from the entire Internet in ten lines of code”Submitted XSS Cheatsheet, by Chris Shiflett as a story · 2 points
HN discussionSubmitted Security Corner: Cross-Site Request Forgeries as a story · 2 points
HN discussionSubmitted Leaders Wanted as a story · 1 points
HN discussionSubmitted Tweet Only Links as a story · 1 points
HN discussionSubmitted XSS Is Still Tricky, by Chris Shiflett as a story · 1 points
HN discussion
