How would one protect against XSS - HTML injection?

[helraizer1]

Hi all,

I've noticed on my friend's site www.sheepeep.com/index.php?p=1 that is easy to manipulate with XSS, I don't mean it in a malicious way at all, just to give an idea as to what people can do.

As an example of such http://www.sheepeep.com/index.php?p=...E%3C/script%3E

With PHP (or any other language, come to that) how would one protect against that?

Sam

[pbmods]

Heya, Sam.

The easiest way to protect against HTML injection is to escape your input using htmlentities().

My recommendation would be to create a validation class and add an escapeHTML() method:

class Validation
{
    public static function escapeHTML( $str )
    {
        return htmlentities($str, ENT_COMPAT, 'UTF-8');
 
        // For PHP 5.2.3 or greater:
        // return htmlentities($str, ENT_COMPAT, 'UTF-8', false);
    }
}
 

Then, whenever you output anything the User input (including $_SERVER['PHP_SELF']):

echo Validation::escapeHTML($_GET['value']);
echo Validation::escapeHTML($_SERVER['PHP_SELF']);
 

etc.

[coffear]

what pbmods says is 100% correct another thing that should be done is proper validation of user input. If for example you ask someone their age then ensure they provide you with an int.