How XSS attacks exploit unescaped output in PHP - Practice Exercises

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code snippet?

Consider this PHP code that outputs user input directly without escaping. What will be the output when the input is <script>alert('XSS')</script>?

PHP

<?php
$user_input = "<script>alert('XSS')</script>";
echo "User says: $user_input";
?>

A User says: <script>alert('XSS')</script>

B User says: &lt;script&gt;alert('XSS')&lt;/script&gt;

C User says: alert('XSS')

D User says: &lt;script&gt;alert(&#039;XSS&#039;)&lt;/script&gt;

💡 Hint

Think about how PHP outputs strings and what happens if HTML tags are included in the string.

The code outputs the raw user input directly. Since the input contains HTML script tags, the browser will interpret and run the script, so the output is exactly User says: <script>alert('XSS')</script> rendered as HTML, which triggers the alert.

🧠 Conceptual

intermediate

Which option best describes why unescaped output leads to XSS?

Why does outputting user input directly without escaping or sanitizing cause Cross-Site Scripting (XSS) vulnerabilities?

A Because escaping input removes all user data before output.

B Because the browser treats unescaped input as plain text and ignores it.

C Because unescaped output encrypts the user input before display.

D Because unescaped input can contain HTML or JavaScript that the browser executes.

💡 Hint

Think about how browsers handle HTML and JavaScript inside web pages.

When user input is output without escaping, any HTML or JavaScript code inside it is interpreted and executed by the browser, allowing attackers to run malicious scripts.

🔧 Debug

advanced

Identify the security flaw in this PHP snippet

Look at this PHP code that outputs a username. What security issue does it have?

PHP

<?php
$username = $_GET['user'];
echo "Welcome, $username!";
?>

A It properly escapes output to prevent XSS.

B It uses a deprecated PHP function causing errors.

C It uses user input directly without escaping, allowing XSS attacks.

D It sanitizes input but forgets to validate it.

💡 Hint

Consider what happens if the user input contains HTML or JavaScript.

The code outputs user input directly without escaping, so if the input contains malicious scripts, they will run in the browser, causing XSS.

📝 Syntax

advanced

Which PHP code correctly escapes output to prevent XSS?

Choose the PHP code snippet that safely outputs user input to prevent XSS attacks.

A <?php echo strip_tags($_GET['input']); ?>

B <?php echo htmlspecialchars($_GET['input'], ENT_QUOTES, 'UTF-8'); ?>

C <?php echo $_GET['input']; ?>

D <?php echo htmlentities($_GET['input']); ?>

💡 Hint

Think about which function converts special characters to HTML entities including quotes.

htmlspecialchars with ENT_QUOTES converts special characters including quotes to safe HTML entities, preventing scripts from running.

🚀 Application

expert

What will be the number of items in the array after this PHP code runs?

This PHP code collects user inputs into an array but does not escape them. How many items will the array contain?

PHP

<?php
$inputs = [];
$inputs[] = '<script>alert(1)</script>';
$inputs[] = 'hello';
$inputs[] = '<img src=x onerror=alert(2)>';
$inputs[] = 'world';
?>

A 4

B 3

C 0

D 2

💡 Hint

Count how many times the array is appended.

The code adds four items to the array, including strings with HTML tags. Escaping is not related to the count of items.

Practice

1. What is the main reason XSS attacks happen in PHP applications?

easy

A. Using too many PHP functions

B. PHP code has syntax errors

C. User input is displayed without escaping special characters

D. Database connection fails

Solution

1. Step 1: Understand XSS attack cause

   XSS attacks exploit when user input is shown directly in HTML without cleaning.

2. Step 2: Identify the vulnerability

   Displaying user input without escaping special characters allows malicious scripts to run.

3. Final Answer:

   User input is displayed without escaping special characters -> Option C

4. Quick Check:

   XSS = unescaped user input [OK]

Hint: XSS = unsafe output from user input [OK]

Common Mistakes:

• Thinking syntax errors cause XSS
• Confusing database errors with XSS
• Believing PHP functions cause XSS

2. Which PHP function is commonly used to prevent XSS by escaping output?

easy

A. json_encode()

B. strtoupper()

C. array_merge()

D. htmlspecialchars()

Solution

1. Step 1: Identify escaping function

   htmlspecialchars() converts special characters to HTML entities, preventing script execution.

2. Step 2: Compare other functions

   strtoupper() changes case, array_merge() combines arrays, json_encode() formats JSON, none escape HTML.

3. Final Answer:

   htmlspecialchars() -> Option D

4. Quick Check:

   Escape HTML = htmlspecialchars() [OK]

Hint: Escape HTML output with htmlspecialchars() [OK]

Common Mistakes:

• Using strtoupper() to escape HTML
• Confusing json_encode() with escaping HTML
• Not escaping output at all

3. What will be the output of this PHP code?

<?php
$user_input = '<script>alert("XSS")</script>';
echo $user_input;
?>

medium

A. An error message

B. <script>alert("XSS")</script>

C. alert("XSS")

D. &lt;script&gt;alert("XSS")&lt;/script&gt;

Solution

1. Step 1: Analyze echo without escaping

   Echo prints the string as is, so HTML tags appear literally and run as code in browser.

2. Step 2: Understand output effect

   The output is the raw script tag, so browser will execute alert("XSS").

3. Final Answer:

   <script>alert("XSS")</script> -> Option B

4. Quick Check:

   Unescaped output = raw script tag [OK]

Hint: Echo raw input shows script tags as is [OK]

Common Mistakes:

• Thinking output is escaped automatically
• Expecting an error message
• Confusing escaped output with raw output

4. Identify the error in this PHP snippet that leads to XSS vulnerability:

<?php
$name = $_GET['name'];
echo "<p>Hello, $name</p>";
?>

medium

A. Missing htmlspecialchars() to escape $name before echo

B. Using double quotes instead of single quotes

C. Not checking if $_GET['name'] is set

D. Echo statement syntax is incorrect

Solution

1. Step 1: Check output handling of user input

   $name is output directly inside HTML without escaping special characters.

2. Step 2: Identify missing security step

   htmlspecialchars() is needed to prevent scripts in $name from running.

3. Final Answer:

   Missing htmlspecialchars() to escape $name before echo -> Option A

4. Quick Check:

   Escape user input before output [OK]

Hint: Always escape variables before echoing HTML [OK]

Common Mistakes:

• Thinking quotes cause XSS
• Ignoring need to escape user input
• Assuming isset check prevents XSS

5. You want to safely display user comments stored in $comment on a webpage. Which code snippet best prevents XSS attacks?

hard

A. <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?>

B. <?php echo strip_tags($comment); ?>

C. <?php echo nl2br($comment); ?>

D. <?php echo $comment; ?>

Solution

1. Step 1: Understand escaping user comments

   htmlspecialchars() converts special characters to safe HTML entities, preventing scripts.

2. Step 2: Compare other options

   strip_tags() removes tags but can remove valid content; nl2br() adds line breaks but no escaping; echo raw outputs unsafe.

3. Final Answer:

   <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?> -> Option A

4. Quick Check:

   Escape all special chars with htmlspecialchars() [OK]

Hint: Use htmlspecialchars() with ENT_QUOTES for full escaping [OK]

Common Mistakes:

• Relying on strip_tags() alone
• Not escaping quotes in output
• Outputting raw user input