I'm trying to identify what exploits to guard against when anonymous users generate reports with PHPword and PHPexcel (or similar libraries).
Specifically, I'm worried about textarea inputs where the user can enter about half a page. The amount of text makes it hard to validate/ sanitise the data.
The two contexts are:
User submits the form to PHPword, it's processed and downloaded to that user only using headers then the file is destroyed using unlink().
User submits the form to PHPexcel, it's processed and a .xlsx written to a folder, then downloaded by us (deleted from server) and executed on our machines.
I am worried the textarea fields are large enough to attack the server or include an .xlxs exploit.
Basically what are the exploits when nothing is output to the browser or stored in a database and there is no session to hijack?
