XSS prevention in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding WordPress XSS Prevention Functions

Which WordPress function is specifically designed to escape HTML attributes to prevent XSS attacks?

A esc_attr()

B sanitize_text_field()

C wp_kses_post()

D esc_html()

💡 Hint

Think about escaping values inside HTML tag attributes like title or alt.

esc_attr() is used to escape data for HTML attributes, preventing XSS by encoding special characters. esc_html() escapes HTML content, wp_kses_post() allows limited HTML tags, and sanitize_text_field() cleans text but does not escape HTML attributes.

❓ component_behavior

intermediate

Output Behavior with Different Escaping Functions

Given the user input <script>alert('XSS')</script>, which WordPress function will output the input safely as plain text on a page without executing the script?

A echo esc_attr( $user_input );

B echo wp_kses_post( $user_input );

C echo esc_html( $user_input );

D echo $user_input;

💡 Hint

Consider which function converts HTML tags to safe text so they show visibly instead of running.

esc_html() converts HTML tags to entities, so the script tag is shown as text, preventing execution. wp_kses_post() allows some HTML tags, so the script tag might be stripped but not escaped. esc_attr() is for attributes, and echoing raw input is unsafe.

📝 Syntax

advanced

Correct Usage of wp_kses() for Custom Allowed Tags

Which option correctly uses wp_kses() to allow only <a> tags with href attributes in user content?

A wp_kses( $content, array( 'a' => array( 'href' => 'true' ) ) );

B wp_kses( $content, array( 'a' => array( 'href' => true ) ) );

C wp_kses( $content, array( 'a' => array( 'href' => 'allowed' ) ) );

D wp_kses( $content, array( 'a' => array( 'href' => 1 ) ) );

💡 Hint

Check the correct data type for allowed attributes in wp_kses().

The allowed attributes array must have attribute names as keys and true (boolean) as values to allow them. Only option B uses true boolean correctly. Option B uses the string 'true' which is invalid. Other options use strings or numbers which are invalid.

🔧 Debug

advanced

Identifying XSS Vulnerability in WordPress Code

What is the main security issue in this WordPress snippet?

$user_input = $_POST['comment'];
echo "<p>User said: $user_input</p>";

Wordpress

$user_input = $_POST['comment'];
echo "<p>User said: $user_input</p>";

A The code sanitizes input but does not escape output, causing XSS.

B The code uses double quotes incorrectly causing syntax error.

C The code properly escapes output, no XSS risk.

D The code outputs raw user input without escaping, allowing XSS.

💡 Hint

Think about what happens if user input contains HTML or script tags.

The code directly outputs user input inside HTML without escaping. This allows attackers to inject scripts. Proper escaping functions like esc_html() or esc_attr() must be used before output.

❓ state_output

expert

Effect of Escaping Functions on Stored and Displayed Data

In WordPress, if you store user input with sanitize_text_field() and later display it with esc_html(), what is the expected behavior?

A User input is cleaned on save and safely displayed as plain text, preventing XSS.

B User input is escaped twice causing visible HTML entities in output.

C User input is not cleaned and can cause XSS on display.

D User input is sanitized but <code>esc_html()</code> causes syntax error on output.

💡 Hint

Consider the difference between sanitizing on input and escaping on output.

sanitize_text_field() cleans input by removing harmful characters before saving. esc_html() safely escapes output for HTML display. Together, they prevent XSS without double escaping or errors.