How XSS attacks exploit unescaped output in PHP - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely display user input in HTML.

PHP

<?php echo htmlspecialchars([1]); ?>

Drag options to blanks, or click blank then click option'

A$_SERVER['input']

B$_POST['input']

C$_COOKIE['input']

D$_GET['input']

Attempts:

3 left

💡 Hint

Common Mistakes

Using $_POST or $_COOKIE when input is from URL

Not escaping output at all

Using htmlspecialchars on $_GET['input'] safely escapes user input from URL parameters to prevent XSS.

2fill in blank

medium

Complete the code to prevent XSS by escaping output inside an HTML attribute.

PHP

<input value="[1]">

Drag options to blanks, or click blank then click option'

A<?php echo htmlspecialchars($_GET['name'], ENT_QUOTES); ?>

B<?php echo $_GET['name']; ?>

C<?php echo strip_tags($_GET['name']); ?>

D<?php echo $_POST['name']; ?>

Attempts:

3 left

💡 Hint

Common Mistakes

Not escaping quotes

Using strip_tags which doesn't escape quotes

Using htmlspecialchars with ENT_QUOTES escapes quotes inside attributes, preventing XSS.

3fill in blank

hard

Fix the error in the code that causes XSS vulnerability.

PHP

<?php echo [1]; ?>

Drag options to blanks, or click blank then click option'

A$_GET['comment']

Bstrip_tags($_GET['comment'])

Chtmlspecialchars($_GET['comment'])

Daddslashes($_GET['comment'])

Attempts:

3 left

💡 Hint

Common Mistakes

Using strip_tags which removes tags but doesn't escape

Using addslashes which is for SQL, not HTML

Directly echoing $_GET['comment'] without escaping allows XSS. Using htmlspecialchars fixes this.

4fill in blank

hard

Fill in the blank to create a safe HTML list from user input array.

PHP

<?php
$items = $_GET['items'];
echo '<ul>';
foreach ($items as $item) {
    echo '<li>' . [1] . '</li>';
}
echo '</ul>';
?>

Drag options to blanks, or click blank then click option'

Ahtmlspecialchars($item)

B$item

Cstrip_tags($item)

Daddslashes($item)

Attempts:

3 left

💡 Hint

Common Mistakes

Outputting raw $item

Using addslashes which is for SQL, not HTML

Escaping each item with htmlspecialchars prevents XSS when displaying user input in HTML lists.

5fill in blank

hard

Fill in the blank to safely display user input in a JavaScript context inside HTML.

PHP

<script>
let userInput = '[1]';
console.log(userInput);
</script>

Drag options to blanks, or click blank then click option'

A<?php echo $_GET['input']; ?>

B<?php echo addslashes($_GET['input']); ?>

C\'

D\\

Attempts:

3 left

💡 Hint

Common Mistakes

Outputting raw input in JS string

Not escaping backslashes or quotes

Use addslashes to escape quotes and backslashes in PHP output for JavaScript strings to prevent XSS.

Practice

1. What is the main reason XSS attacks happen in PHP applications?

easy

A. Using too many PHP functions

B. PHP code has syntax errors

C. User input is displayed without escaping special characters

D. Database connection fails

Solution

1. Step 1: Understand XSS attack cause

   XSS attacks exploit when user input is shown directly in HTML without cleaning.

2. Step 2: Identify the vulnerability

   Displaying user input without escaping special characters allows malicious scripts to run.

3. Final Answer:

   User input is displayed without escaping special characters -> Option C

4. Quick Check:

   XSS = unescaped user input [OK]

Hint: XSS = unsafe output from user input [OK]

Common Mistakes:

• Thinking syntax errors cause XSS
• Confusing database errors with XSS
• Believing PHP functions cause XSS

2. Which PHP function is commonly used to prevent XSS by escaping output?

easy

A. json_encode()

B. strtoupper()

C. array_merge()

D. htmlspecialchars()

Solution

1. Step 1: Identify escaping function

   htmlspecialchars() converts special characters to HTML entities, preventing script execution.

2. Step 2: Compare other functions

   strtoupper() changes case, array_merge() combines arrays, json_encode() formats JSON, none escape HTML.

3. Final Answer:

   htmlspecialchars() -> Option D

4. Quick Check:

   Escape HTML = htmlspecialchars() [OK]

Hint: Escape HTML output with htmlspecialchars() [OK]

Common Mistakes:

• Using strtoupper() to escape HTML
• Confusing json_encode() with escaping HTML
• Not escaping output at all

3. What will be the output of this PHP code?

<?php
$user_input = '<script>alert("XSS")</script>';
echo $user_input;
?>

medium

A. An error message

B. <script>alert("XSS")</script>

C. alert("XSS")

D. &lt;script&gt;alert("XSS")&lt;/script&gt;

Solution

1. Step 1: Analyze echo without escaping

   Echo prints the string as is, so HTML tags appear literally and run as code in browser.

2. Step 2: Understand output effect

   The output is the raw script tag, so browser will execute alert("XSS").

3. Final Answer:

   <script>alert("XSS")</script> -> Option B

4. Quick Check:

   Unescaped output = raw script tag [OK]

Hint: Echo raw input shows script tags as is [OK]

Common Mistakes:

• Thinking output is escaped automatically
• Expecting an error message
• Confusing escaped output with raw output

4. Identify the error in this PHP snippet that leads to XSS vulnerability:

<?php
$name = $_GET['name'];
echo "<p>Hello, $name</p>";
?>

medium

A. Missing htmlspecialchars() to escape $name before echo

B. Using double quotes instead of single quotes

C. Not checking if $_GET['name'] is set

D. Echo statement syntax is incorrect

Solution

1. Step 1: Check output handling of user input

   $name is output directly inside HTML without escaping special characters.

2. Step 2: Identify missing security step

   htmlspecialchars() is needed to prevent scripts in $name from running.

3. Final Answer:

   Missing htmlspecialchars() to escape $name before echo -> Option A

4. Quick Check:

   Escape user input before output [OK]

Hint: Always escape variables before echoing HTML [OK]

Common Mistakes:

• Thinking quotes cause XSS
• Ignoring need to escape user input
• Assuming isset check prevents XSS

5. You want to safely display user comments stored in $comment on a webpage. Which code snippet best prevents XSS attacks?

hard

A. <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?>

B. <?php echo strip_tags($comment); ?>

C. <?php echo nl2br($comment); ?>

D. <?php echo $comment; ?>

Solution

1. Step 1: Understand escaping user comments

   htmlspecialchars() converts special characters to safe HTML entities, preventing scripts.

2. Step 2: Compare other options

   strip_tags() removes tags but can remove valid content; nl2br() adds line breaks but no escaping; echo raw outputs unsafe.

3. Final Answer:

   <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?> -> Option A

4. Quick Check:

   Escape all special chars with htmlspecialchars() [OK]

Hint: Use htmlspecialchars() with ENT_QUOTES for full escaping [OK]

Common Mistakes:

• Relying on strip_tags() alone
• Not escaping quotes in output
• Outputting raw user input