XSS prevention in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding WordPress XSS Prevention Functions

Which WordPress function is specifically designed to escape HTML attributes to prevent XSS attacks?

A esc_attr()

B sanitize_text_field()

C wp_kses_post()

D esc_html()

💡 Hint

Think about escaping values inside HTML tag attributes like title or alt.

esc_attr() is used to escape data for HTML attributes, preventing XSS by encoding special characters. esc_html() escapes HTML content, wp_kses_post() allows limited HTML tags, and sanitize_text_field() cleans text but does not escape HTML attributes.

❓ component_behavior

intermediate

Output Behavior with Different Escaping Functions

Given the user input <script>alert('XSS')</script>, which WordPress function will output the input safely as plain text on a page without executing the script?

A echo esc_attr( $user_input );

B echo wp_kses_post( $user_input );

C echo esc_html( $user_input );

D echo $user_input;

💡 Hint

Consider which function converts HTML tags to safe text so they show visibly instead of running.

esc_html() converts HTML tags to entities, so the script tag is shown as text, preventing execution. wp_kses_post() allows some HTML tags, so the script tag might be stripped but not escaped. esc_attr() is for attributes, and echoing raw input is unsafe.

📝 Syntax

advanced

Correct Usage of wp_kses() for Custom Allowed Tags

Which option correctly uses wp_kses() to allow only <a> tags with href attributes in user content?

A wp_kses( $content, array( 'a' => array( 'href' => 'true' ) ) );

B wp_kses( $content, array( 'a' => array( 'href' => true ) ) );

C wp_kses( $content, array( 'a' => array( 'href' => 'allowed' ) ) );

D wp_kses( $content, array( 'a' => array( 'href' => 1 ) ) );

💡 Hint

Check the correct data type for allowed attributes in wp_kses().

The allowed attributes array must have attribute names as keys and true (boolean) as values to allow them. Only option B uses true boolean correctly. Option B uses the string 'true' which is invalid. Other options use strings or numbers which are invalid.

🔧 Debug

advanced

Identifying XSS Vulnerability in WordPress Code

What is the main security issue in this WordPress snippet?

$user_input = $_POST['comment'];
echo "<p>User said: $user_input</p>";

Wordpress

$user_input = $_POST['comment'];
echo "<p>User said: $user_input</p>";

A The code sanitizes input but does not escape output, causing XSS.

B The code uses double quotes incorrectly causing syntax error.

C The code properly escapes output, no XSS risk.

D The code outputs raw user input without escaping, allowing XSS.

💡 Hint

Think about what happens if user input contains HTML or script tags.

The code directly outputs user input inside HTML without escaping. This allows attackers to inject scripts. Proper escaping functions like esc_html() or esc_attr() must be used before output.

❓ state_output

expert

Effect of Escaping Functions on Stored and Displayed Data

In WordPress, if you store user input with sanitize_text_field() and later display it with esc_html(), what is the expected behavior?

A User input is cleaned on save and safely displayed as plain text, preventing XSS.

B User input is escaped twice causing visible HTML entities in output.

C User input is not cleaned and can cause XSS on display.

D User input is sanitized but <code>esc_html()</code> causes syntax error on output.

💡 Hint

Consider the difference between sanitizing on input and escaping on output.

sanitize_text_field() cleans input by removing harmful characters before saving. esc_html() safely escapes output for HTML display. Together, they prevent XSS without double escaping or errors.

Practice

1. What is the main purpose of XSS prevention in WordPress?

easy

A. To improve SEO rankings

B. To speed up website loading time

C. To stop harmful scripts from running on your website

D. To add more images to your site

Solution

1. Step 1: Understand what XSS means

   XSS stands for Cross-Site Scripting, which allows attackers to run harmful scripts on your site.

2. Step 2: Identify the goal of prevention

   The goal is to stop these harmful scripts from running to protect users and the site.

3. Final Answer:

   To stop harmful scripts from running on your website -> Option C

4. Quick Check:

   XSS prevention = stop harmful scripts [OK]

Hint: XSS prevention blocks bad scripts from running [OK]

Common Mistakes:

• Thinking XSS prevention improves speed
• Confusing XSS with SEO improvements
• Believing it adds content automatically

2. Which WordPress function is used to safely escape text before outputting it to prevent XSS?

easy

A. esc_html()

B. wp_kses_post()

C. sanitize_text_field()

D. wp_enqueue_script()

Solution

1. Step 1: Identify escaping functions for output

   esc_html() escapes text for safe HTML output, preventing scripts from running.

2. Step 2: Differentiate from other functions

   wp_kses_post() allows some HTML, sanitize_text_field() cleans input, wp_enqueue_script() loads scripts.

3. Final Answer:

   esc_html() -> Option A

4. Quick Check:

   Escape text output = esc_html() [OK]

Hint: Use esc_html() to escape text output safely [OK]

Common Mistakes:

• Using sanitize_text_field() for output escaping
• Confusing wp_kses_post() with esc_html()
• Thinking wp_enqueue_script() escapes text

3. What will be the output of this code snippet if user input is <script>alert('XSS')</script>?

<?php
echo esc_html($_GET['input']);
?>

medium

A. PHP error

B. (runs alert)

C. Empty output

D. <script>alert('XSS')</script> (shown as text)

Solution

1. Step 1: Understand esc_html() effect

   esc_html() converts special HTML characters to safe text, so tags show as text, not code.

2. Step 2: Predict output with given input

   The script tags will be shown as <script>alert('XSS')</script> literally, not executed.

3. Final Answer:

   <script>alert('XSS')</script> (shown as text) -> Option D

4. Quick Check:

   esc_html() escapes tags to text [OK]

Hint: esc_html() shows tags as text, not code [OK]

Common Mistakes:

• Thinking script runs despite escaping
• Expecting empty output
• Assuming PHP error occurs

4. Identify the error in this code that tries to prevent XSS:

<?php
$user_input = $_POST['comment'];
echo $user_input;
?>

medium

A. Missing escaping function before echoing user input

B. Using $_POST instead of $_GET

C. Variable name is incorrect

D. No error, code is safe

Solution

1. Step 1: Check how user input is output

   The code echoes raw user input without escaping, which can run harmful scripts.

2. Step 2: Identify missing security step

   It should use an escaping function like esc_html() before echoing to prevent XSS.

3. Final Answer:

   Missing escaping function before echoing user input -> Option A

4. Quick Check:

   Always escape user output [OK]

Hint: Always escape user data before echoing [OK]

Common Mistakes:

• Thinking $_POST vs $_GET matters here
• Believing variable name causes error
• Assuming raw echo is safe

5. You want to allow some HTML tags like <strong> and <a> in user comments but prevent scripts. Which WordPress function should you use?

hard

A. sanitize_text_field()

B. wp_kses()

C. esc_html()

D. wp_strip_all_tags()

Solution

1. Step 1: Understand the need to allow some HTML safely

   esc_html() escapes all HTML, sanitize_text_field() removes tags, wp_strip_all_tags() removes all tags.

2. Step 2: Identify function that allows specific tags

   wp_kses() lets you specify allowed tags and attributes, filtering out harmful scripts but keeping safe HTML.

3. Final Answer:

   wp_kses() -> Option B

4. Quick Check:

   Allow safe HTML = wp_kses() [OK]

Hint: Use wp_kses() to allow safe HTML tags only [OK]

Common Mistakes:

• Using esc_html() which escapes all tags
• Using sanitize_text_field() which removes tags
• Assuming wp_strip_all_tags() allows some HTML