How XSS attacks exploit unescaped output in PHP - Try It Yourself

How XSS Attacks Exploit Unescaped Output

📖 Scenario: You are building a simple PHP web page that shows user comments. This page does not escape user input before showing it. This can cause a security problem called Cross-Site Scripting (XSS).XSS happens when a user enters code that runs in other users' browsers, which can steal information or cause harm.

🎯 Goal: Learn how unescaped output can let harmful code run on a web page by creating a PHP script that shows user comments without escaping, then see how an attacker can add a script tag.

📋 What You'll Learn

Create an array called comments with user comments including a normal comment and a comment with a script tag

Create a variable called output to hold the combined comments as a string

Use a foreach loop with variables comment to add each comment to output without escaping

Print the output variable to show the comments on the page

💡 Why This Matters

🌍 Real World

Web developers must always escape user input before showing it on pages to protect users from XSS attacks.

💼 Career

Understanding XSS and safe output handling is essential for secure web development jobs and protecting websites from hackers.

1

Create the comments array

Create an array called comments with these exact entries: 'Hello, this is a safe comment.' and ''

PHP

# Create the comments array with two entries
# Your code here

Hint

Use $comments = [ ... ]; to create the array with the exact two strings.

2

Create the output variable

Create a variable called output and set it to an empty string ""

PHP

alert("XSS Attack!");'
];

# Create the output variable as an empty string
# Your code here

Hint

Use $output = ""; to start with an empty string.

3

Add comments to output without escaping

Use a foreach loop with variable comment to add each comment from $comments to $output by concatenating $comment and a line break "<br>" without escaping

PHP

alert("XSS Attack!");'
];

$output = "";

# Use foreach to add comments to output without escaping
# Your code here

Hint

Use foreach ($comments as $comment) { $output .= $comment . "<br>"; } to add each comment with a line break.

4

Print the output

Write echo $output; to display the combined comments on the page

PHP

alert("XSS Attack!");'
];

$output = "";

foreach ($comments as $comment) {
    $output .= $comment . "";
}

# Print the output
# Your code here

Hint

Use echo $output; to show the comments on the page.

Practice

1. What is the main reason XSS attacks happen in PHP applications?

easy

A. Using too many PHP functions

B. PHP code has syntax errors

C. User input is displayed without escaping special characters

D. Database connection fails

Solution

1. Step 1: Understand XSS attack cause

   XSS attacks exploit when user input is shown directly in HTML without cleaning.

2. Step 2: Identify the vulnerability

   Displaying user input without escaping special characters allows malicious scripts to run.

3. Final Answer:

   User input is displayed without escaping special characters -> Option C

4. Quick Check:

   XSS = unescaped user input [OK]

Hint: XSS = unsafe output from user input [OK]

Common Mistakes:

• Thinking syntax errors cause XSS
• Confusing database errors with XSS
• Believing PHP functions cause XSS

2. Which PHP function is commonly used to prevent XSS by escaping output?

easy

A. json_encode()

B. strtoupper()

C. array_merge()

D. htmlspecialchars()

Solution

1. Step 1: Identify escaping function

   htmlspecialchars() converts special characters to HTML entities, preventing script execution.

2. Step 2: Compare other functions

   strtoupper() changes case, array_merge() combines arrays, json_encode() formats JSON, none escape HTML.

3. Final Answer:

   htmlspecialchars() -> Option D

4. Quick Check:

   Escape HTML = htmlspecialchars() [OK]

Hint: Escape HTML output with htmlspecialchars() [OK]

Common Mistakes:

• Using strtoupper() to escape HTML
• Confusing json_encode() with escaping HTML
• Not escaping output at all

3. What will be the output of this PHP code?

<?php
$user_input = '<script>alert("XSS")</script>';
echo $user_input;
?>

medium

A. An error message

B. <script>alert("XSS")</script>

C. alert("XSS")

D. &lt;script&gt;alert("XSS")&lt;/script&gt;

Solution

1. Step 1: Analyze echo without escaping

   Echo prints the string as is, so HTML tags appear literally and run as code in browser.

2. Step 2: Understand output effect

   The output is the raw script tag, so browser will execute alert("XSS").

3. Final Answer:

   <script>alert("XSS")</script> -> Option B

4. Quick Check:

   Unescaped output = raw script tag [OK]

Hint: Echo raw input shows script tags as is [OK]

Common Mistakes:

• Thinking output is escaped automatically
• Expecting an error message
• Confusing escaped output with raw output

4. Identify the error in this PHP snippet that leads to XSS vulnerability:

<?php
$name = $_GET['name'];
echo "<p>Hello, $name</p>";
?>

medium

A. Missing htmlspecialchars() to escape $name before echo

B. Using double quotes instead of single quotes

C. Not checking if $_GET['name'] is set

D. Echo statement syntax is incorrect

Solution

1. Step 1: Check output handling of user input

   $name is output directly inside HTML without escaping special characters.

2. Step 2: Identify missing security step

   htmlspecialchars() is needed to prevent scripts in $name from running.

3. Final Answer:

   Missing htmlspecialchars() to escape $name before echo -> Option A

4. Quick Check:

   Escape user input before output [OK]

Hint: Always escape variables before echoing HTML [OK]

Common Mistakes:

• Thinking quotes cause XSS
• Ignoring need to escape user input
• Assuming isset check prevents XSS

5. You want to safely display user comments stored in $comment on a webpage. Which code snippet best prevents XSS attacks?

hard

A. <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?>

B. <?php echo strip_tags($comment); ?>

C. <?php echo nl2br($comment); ?>

D. <?php echo $comment; ?>

Solution

1. Step 1: Understand escaping user comments

   htmlspecialchars() converts special characters to safe HTML entities, preventing scripts.

2. Step 2: Compare other options

   strip_tags() removes tags but can remove valid content; nl2br() adds line breaks but no escaping; echo raw outputs unsafe.

3. Final Answer:

   <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?> -> Option A

4. Quick Check:

   Escape all special chars with htmlspecialchars() [OK]

Hint: Use htmlspecialchars() with ENT_QUOTES for full escaping [OK]

Common Mistakes:

• Relying on strip_tags() alone
• Not escaping quotes in output
• Outputting raw user input