Codeigniter会话XSS过滤

Question

does it makes any sense to check if user's session item is xss clean?

Something like this:

$item = $this->security->xss_clean($this->session->item);

Is there any possibility that session can contain any harmful code?

Answer 1

Short answer: Yes .

If $this->session->item is populated by a malicious user (eg some input textbox or fake $_POST data ) then it is vulnerable to harmful code.

Even if this session variable is really stored in your session, it could be inserted in a database, for example.