How XSS attacks exploit unescaped output in PHP - Practice Exercises

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code snippet?

Consider this PHP code that outputs user input directly without escaping. What will be the output when the input is <script>alert('XSS')</script>?

PHP

<?php
$user_input = "<script>alert('XSS')</script>";
echo "User says: $user_input";
?>

A User says: <script>alert('XSS')</script>

B User says: &lt;script&gt;alert('XSS')&lt;/script&gt;

C User says: alert('XSS')

D User says: &lt;script&gt;alert(&#039;XSS&#039;)&lt;/script&gt;

💡 Hint

Think about how PHP outputs strings and what happens if HTML tags are included in the string.

The code outputs the raw user input directly. Since the input contains HTML script tags, the browser will interpret and run the script, so the output is exactly User says: <script>alert('XSS')</script> rendered as HTML, which triggers the alert.

🧠 Conceptual

intermediate

Which option best describes why unescaped output leads to XSS?

Why does outputting user input directly without escaping or sanitizing cause Cross-Site Scripting (XSS) vulnerabilities?

A Because escaping input removes all user data before output.

B Because the browser treats unescaped input as plain text and ignores it.

C Because unescaped output encrypts the user input before display.

D Because unescaped input can contain HTML or JavaScript that the browser executes.

💡 Hint

Think about how browsers handle HTML and JavaScript inside web pages.

When user input is output without escaping, any HTML or JavaScript code inside it is interpreted and executed by the browser, allowing attackers to run malicious scripts.

🔧 Debug

advanced

Identify the security flaw in this PHP snippet

Look at this PHP code that outputs a username. What security issue does it have?

PHP

<?php
$username = $_GET['user'];
echo "Welcome, $username!";
?>

A It properly escapes output to prevent XSS.

B It uses a deprecated PHP function causing errors.

C It uses user input directly without escaping, allowing XSS attacks.

D It sanitizes input but forgets to validate it.

💡 Hint

Consider what happens if the user input contains HTML or JavaScript.

The code outputs user input directly without escaping, so if the input contains malicious scripts, they will run in the browser, causing XSS.

📝 Syntax

advanced

Which PHP code correctly escapes output to prevent XSS?

Choose the PHP code snippet that safely outputs user input to prevent XSS attacks.

A <?php echo strip_tags($_GET['input']); ?>

B <?php echo htmlspecialchars($_GET['input'], ENT_QUOTES, 'UTF-8'); ?>

C <?php echo $_GET['input']; ?>

D <?php echo htmlentities($_GET['input']); ?>

💡 Hint

Think about which function converts special characters to HTML entities including quotes.

htmlspecialchars with ENT_QUOTES converts special characters including quotes to safe HTML entities, preventing scripts from running.

🚀 Application

expert

What will be the number of items in the array after this PHP code runs?

This PHP code collects user inputs into an array but does not escape them. How many items will the array contain?

PHP

<?php
$inputs = [];
$inputs[] = '<script>alert(1)</script>';
$inputs[] = 'hello';
$inputs[] = '<img src=x onerror=alert(2)>';
$inputs[] = 'world';
?>

A 4

B 3

C 0

D 2

💡 Hint

Count how many times the array is appended.

The code adds four items to the array, including strings with HTML tags. Escaping is not related to the count of items.