Server logging - Apache HTTP server

Question

"In addition, log files may contain information supplied directly by the client, without escaping. Therefore , it is possible for malicious clients to insert control-characters in the log files, so care must be taken in dealing with raw logs."

http://httpd.apache.org/docs/1.3/logs.html

What does it mean when it says "without escaping" ?

Answer 1

转义是指当您使用CRLF（Windows样式的换行符）并将其转换为\\ r \\ n时，这是您需要执行的2个“转义”字符，\\ t是制表符等。它会将它们呈现为他们无法完成的表单，但您知道那是它们所在的位置，可以将其恢复为原始格式

Answer 2

Read: http://en.wikipedia.org/wiki/Code_injection#Shell_injection

If I was to escape html, <a> would be escaped to <a>

This way the code wouldn't be rendered and won't execute (and is thus considered safe).

If I was accepting user input, and rendered their input directly back to other users, someone might put malicious code in there. Eg: http://myunsafesite.com?comment=<script>alert('i steal cookies')</script>

While the above example doesn't apply to a log file, it is the same principle on the file system. Successful exploits may allow attackers to create new files and execute code on the web server.