How XSS attacks exploit unescaped output in PHP - Visual Walkthrough

Concept Flow - How XSS attacks exploit unescaped output

User Input

↓

Input Stored

↓

Output Without Escaping

↓

Browser Executes Malicious Script

↓

XSS Attack Successful

↓

User Data Compromised

User input is stored and then output without escaping, causing the browser to run malicious scripts, leading to an XSS attack.

Execution Sample

PHP

<?php
$user_input = "<script>alert('XSS');</script>";
echo "User says: $user_input";
?>

This PHP code outputs user input directly without escaping, allowing script tags to run in the browser.

Execution Table

Step	Variable	Value	Action	Output
1	$user_input	"<script>alert('XSS');</script>"	Assign user input	No output yet
2	echo	User says: <script>alert('XSS');</script>	Output user input directly	Browser renders and executes alert popup
3	Browser	Executes <script>alert('XSS');</script>	Runs JavaScript from output	Alert box with 'XSS' appears
4	-	-	XSS attack successful	User data compromised

💡 Execution stops after browser runs the malicious script embedded in output.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
$user_input	undefined	"<script>alert('XSS');</script>"	"<script>alert('XSS');</script>"	"<script>alert('XSS');</script>"

Key Moments - 2 Insights

Why does the browser run the script inside the user input?

Because the PHP code outputs the user input directly without escaping, the browser treats the <script> tags as executable code (see execution_table step 2 and 3).

What would happen if the output was escaped properly?

If escaped, the <script> tags would be shown as text, not run as code, preventing the alert popup and XSS attack (not shown in this trace but implied).

Visual Quiz - 3 Questions

Look at the execution table, what is the value of $user_input after step 1?

A "<script>alert('XSS');</script>"

B "alert('XSS');"

C "User says: <script>alert('XSS');</script>"

D undefined

💡 Hint

Check the 'Value' column for $user_input at step 1 in the execution_table.

At which step does the browser execute the malicious script?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at the 'Action' and 'Output' columns in execution_table for when the browser runs the script.

If the PHP code escaped the output, what would change in the execution table?

A The $user_input value would change.

B The echo statement would not run.

C The browser would not execute the script in step 3.

D The alert popup would appear twice.

💡 Hint

Escaping output changes how the browser treats the script tags, see key_moments explanation.

Concept Snapshot

XSS attacks happen when user input with scripts is output without escaping.
PHP echo outputs raw input, so browsers run scripts inside.
Always escape output to show scripts as text, not code.
Unescaped output = security risk.
Escaping stops XSS by neutralizing scripts.

Full Transcript

This example shows how a PHP script outputs user input directly without escaping. The input contains a script tag that triggers an alert in the browser. The execution table traces the variable assignment, output, and browser execution steps. The variable tracker shows the user input remains unchanged. Key moments explain why the browser runs the script and how escaping output prevents this. The quiz tests understanding of variable values and execution steps. The snapshot summarizes the risk of unescaped output and the need to escape to prevent XSS attacks.

Practice

1. What is the main reason XSS attacks happen in PHP applications?

easy

A. Using too many PHP functions

B. PHP code has syntax errors

C. User input is displayed without escaping special characters

D. Database connection fails

Solution

1. Step 1: Understand XSS attack cause

   XSS attacks exploit when user input is shown directly in HTML without cleaning.

2. Step 2: Identify the vulnerability

   Displaying user input without escaping special characters allows malicious scripts to run.

3. Final Answer:

   User input is displayed without escaping special characters -> Option C

4. Quick Check:

   XSS = unescaped user input [OK]

Hint: XSS = unsafe output from user input [OK]

Common Mistakes:

• Thinking syntax errors cause XSS
• Confusing database errors with XSS
• Believing PHP functions cause XSS

2. Which PHP function is commonly used to prevent XSS by escaping output?

easy

A. json_encode()

B. strtoupper()

C. array_merge()

D. htmlspecialchars()

Solution

1. Step 1: Identify escaping function

   htmlspecialchars() converts special characters to HTML entities, preventing script execution.

2. Step 2: Compare other functions

   strtoupper() changes case, array_merge() combines arrays, json_encode() formats JSON, none escape HTML.

3. Final Answer:

   htmlspecialchars() -> Option D

4. Quick Check:

   Escape HTML = htmlspecialchars() [OK]

Hint: Escape HTML output with htmlspecialchars() [OK]

Common Mistakes:

• Using strtoupper() to escape HTML
• Confusing json_encode() with escaping HTML
• Not escaping output at all

3. What will be the output of this PHP code?

<?php
$user_input = '<script>alert("XSS")</script>';
echo $user_input;
?>

medium

A. An error message

B. <script>alert("XSS")</script>

C. alert("XSS")

D. &lt;script&gt;alert("XSS")&lt;/script&gt;

Solution

1. Step 1: Analyze echo without escaping

   Echo prints the string as is, so HTML tags appear literally and run as code in browser.

2. Step 2: Understand output effect

   The output is the raw script tag, so browser will execute alert("XSS").

3. Final Answer:

   <script>alert("XSS")</script> -> Option B

4. Quick Check:

   Unescaped output = raw script tag [OK]

Hint: Echo raw input shows script tags as is [OK]

Common Mistakes:

• Thinking output is escaped automatically
• Expecting an error message
• Confusing escaped output with raw output

4. Identify the error in this PHP snippet that leads to XSS vulnerability:

<?php
$name = $_GET['name'];
echo "<p>Hello, $name</p>";
?>

medium

A. Missing htmlspecialchars() to escape $name before echo

B. Using double quotes instead of single quotes

C. Not checking if $_GET['name'] is set

D. Echo statement syntax is incorrect

Solution

1. Step 1: Check output handling of user input

   $name is output directly inside HTML without escaping special characters.

2. Step 2: Identify missing security step

   htmlspecialchars() is needed to prevent scripts in $name from running.

3. Final Answer:

   Missing htmlspecialchars() to escape $name before echo -> Option A

4. Quick Check:

   Escape user input before output [OK]

Hint: Always escape variables before echoing HTML [OK]

Common Mistakes:

• Thinking quotes cause XSS
• Ignoring need to escape user input
• Assuming isset check prevents XSS

5. You want to safely display user comments stored in $comment on a webpage. Which code snippet best prevents XSS attacks?

hard

A. <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?>

B. <?php echo strip_tags($comment); ?>

C. <?php echo nl2br($comment); ?>

D. <?php echo $comment; ?>

Solution

1. Step 1: Understand escaping user comments

   htmlspecialchars() converts special characters to safe HTML entities, preventing scripts.

2. Step 2: Compare other options

   strip_tags() removes tags but can remove valid content; nl2br() adds line breaks but no escaping; echo raw outputs unsafe.

3. Final Answer:

   <?php echo htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5); ?> -> Option A

4. Quick Check:

   Escape all special chars with htmlspecialchars() [OK]

Hint: Use htmlspecialchars() with ENT_QUOTES for full escaping [OK]

Common Mistakes:

• Relying on strip_tags() alone
• Not escaping quotes in output
• Outputting raw user input