XSS prevention in Wordpress - Mini Project: Build & Apply

XSS Prevention in WordPress Theme

📖 Scenario: You are building a simple WordPress theme that displays user-submitted comments safely.Users can enter comments on posts, but you want to prevent harmful scripts from running on your site.

🎯 Goal: Build a WordPress theme snippet that safely outputs user comments by preventing cross-site scripting (XSS) attacks using WordPress functions.

📋 What You'll Learn

Create a PHP array called $comments with exact user comment strings including one with a script tag

Add a variable $allowed_tags that defines which HTML tags are allowed in comments

Use wp_kses() function to sanitize each comment allowing only the allowed tags

Echo the sanitized comments inside <div> elements in a loop

💡 Why This Matters

🌍 Real World

Preventing XSS attacks is critical when displaying user-generated content on WordPress sites to keep visitors safe.

💼 Career

Web developers must know how to sanitize and escape content properly to build secure WordPress themes and plugins.

1

Create the comments data array

Create a PHP array called $comments with these exact strings: 'Hello, this is safe!', 'Nice post! <script>alert("XSS")</script>', and 'Thanks for sharing.'

Wordpress

<?php

// Create the $comments array with exact strings
# Your code here

Hint

Use square brackets [] to create the array and include the exact strings with quotes.

2

Define allowed HTML tags for comments

Add a variable called $allowed_tags that allows only <b> and <i> tags in comments. Use an associative array with keys 'b' and 'i' and empty arrays as values.

Wordpress

alert("XSS")',
    'Thanks for sharing.'
];

// Define $allowed_tags array for  and  tags
# Your code here

Hint

Allowed tags array keys are tag names as strings, values are empty arrays.

3

Sanitize comments using wp_kses

Use a foreach loop with variable $comment to iterate over $comments. Inside the loop, create a variable $safe_comment that stores the sanitized comment using wp_kses($comment, $allowed_tags).

Wordpress

alert("XSS")',
    'Thanks for sharing.'
];

$allowed_tags = [
    'b' => [],
    'i' => []
];

// Loop through $comments and sanitize each with wp_kses
# Your code here

Hint

Use foreach ($comments as $comment) and assign sanitized result to $safe_comment.

4

Output sanitized comments inside div elements

Inside the foreach loop, echo each $safe_comment wrapped in a <div> element. Use echo '<div>' . $safe_comment . '</div>'; exactly.

Wordpress

alert("XSS")',
    'Thanks for sharing.'
];

$allowed_tags = [
    'b' => [],
    'i' => []
];

foreach ($comments as $comment) {
    $safe_comment = wp_kses($comment, $allowed_tags);
    // Echo $safe_comment inside a 
    # Your code here
}

Hint

Use string concatenation to wrap the sanitized comment in a div and echo it.

Practice

1. What is the main purpose of XSS prevention in WordPress?

easy

A. To improve SEO rankings

B. To speed up website loading time

C. To stop harmful scripts from running on your website

D. To add more images to your site

Solution

1. Step 1: Understand what XSS means

   XSS stands for Cross-Site Scripting, which allows attackers to run harmful scripts on your site.

2. Step 2: Identify the goal of prevention

   The goal is to stop these harmful scripts from running to protect users and the site.

3. Final Answer:

   To stop harmful scripts from running on your website -> Option C

4. Quick Check:

   XSS prevention = stop harmful scripts [OK]

Hint: XSS prevention blocks bad scripts from running [OK]

Common Mistakes:

• Thinking XSS prevention improves speed
• Confusing XSS with SEO improvements
• Believing it adds content automatically

2. Which WordPress function is used to safely escape text before outputting it to prevent XSS?

easy

A. esc_html()

B. wp_kses_post()

C. sanitize_text_field()

D. wp_enqueue_script()

Solution

1. Step 1: Identify escaping functions for output

   esc_html() escapes text for safe HTML output, preventing scripts from running.

2. Step 2: Differentiate from other functions

   wp_kses_post() allows some HTML, sanitize_text_field() cleans input, wp_enqueue_script() loads scripts.

3. Final Answer:

   esc_html() -> Option A

4. Quick Check:

   Escape text output = esc_html() [OK]

Hint: Use esc_html() to escape text output safely [OK]

Common Mistakes:

• Using sanitize_text_field() for output escaping
• Confusing wp_kses_post() with esc_html()
• Thinking wp_enqueue_script() escapes text

3. What will be the output of this code snippet if user input is <script>alert('XSS')</script>?

<?php
echo esc_html($_GET['input']);
?>

medium

A. PHP error

B. (runs alert)

C. Empty output

D. <script>alert('XSS')</script> (shown as text)

Solution

1. Step 1: Understand esc_html() effect

   esc_html() converts special HTML characters to safe text, so tags show as text, not code.

2. Step 2: Predict output with given input

   The script tags will be shown as <script>alert('XSS')</script> literally, not executed.

3. Final Answer:

   <script>alert('XSS')</script> (shown as text) -> Option D

4. Quick Check:

   esc_html() escapes tags to text [OK]

Hint: esc_html() shows tags as text, not code [OK]

Common Mistakes:

• Thinking script runs despite escaping
• Expecting empty output
• Assuming PHP error occurs

4. Identify the error in this code that tries to prevent XSS:

<?php
$user_input = $_POST['comment'];
echo $user_input;
?>

medium

A. Missing escaping function before echoing user input

B. Using $_POST instead of $_GET

C. Variable name is incorrect

D. No error, code is safe

Solution

1. Step 1: Check how user input is output

   The code echoes raw user input without escaping, which can run harmful scripts.

2. Step 2: Identify missing security step

   It should use an escaping function like esc_html() before echoing to prevent XSS.

3. Final Answer:

   Missing escaping function before echoing user input -> Option A

4. Quick Check:

   Always escape user output [OK]

Hint: Always escape user data before echoing [OK]

Common Mistakes:

• Thinking $_POST vs $_GET matters here
• Believing variable name causes error
• Assuming raw echo is safe

5. You want to allow some HTML tags like <strong> and <a> in user comments but prevent scripts. Which WordPress function should you use?

hard

A. sanitize_text_field()

B. wp_kses()

C. esc_html()

D. wp_strip_all_tags()

Solution

1. Step 1: Understand the need to allow some HTML safely

   esc_html() escapes all HTML, sanitize_text_field() removes tags, wp_strip_all_tags() removes all tags.

2. Step 2: Identify function that allows specific tags

   wp_kses() lets you specify allowed tags and attributes, filtering out harmful scripts but keeping safe HTML.

3. Final Answer:

   wp_kses() -> Option B

4. Quick Check:

   Allow safe HTML = wp_kses() [OK]

Hint: Use wp_kses() to allow safe HTML tags only [OK]

Common Mistakes:

• Using esc_html() which escapes all tags
• Using sanitize_text_field() which removes tags
• Assuming wp_strip_all_tags() allows some HTML