XSS prevention in Wordpress - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does XSS stand for and why is it dangerous in WordPress?

XSS stands for Cross-Site Scripting. It is dangerous because attackers can inject harmful scripts into web pages viewed by other users, stealing data or hijacking sessions.

beginner

Which WordPress function should you use to safely output data in HTML to prevent XSS?

Use esc_html() to safely output data inside HTML content, escaping harmful characters to prevent XSS.

intermediate

How does esc_attr() help in XSS prevention?

esc_attr() escapes data before placing it inside HTML attributes, stopping attackers from injecting scripts via attributes.

beginner

Why should you never trust user input directly in WordPress?

User input can contain malicious code. Always sanitize and escape it before use to prevent XSS and other attacks.

intermediate

What is the difference between sanitizing and escaping in WordPress XSS prevention?

Sanitizing cleans input data before saving it. Escaping cleans data before outputting it. Both protect against XSS but at different stages.

Which WordPress function escapes data for safe use inside HTML attributes?

A esc_html()

B esc_attr()

C sanitize_text_field()

D wp_kses()

esc_attr() is used to escape data inside HTML attributes to prevent XSS.

What is the main purpose of wp_kses() in WordPress?

A To sanitize input by allowing only certain HTML tags

B To escape data for JavaScript output

C To encrypt user passwords

D To minify CSS files

wp_kses() filters input to allow only safe HTML tags, helping prevent XSS.

When should you escape data in WordPress to prevent XSS?

A Only when receiving data from the user

B Only when saving data to the database

C Right before outputting it to the browser

D Never, WordPress does it automatically

Escaping should happen right before output to ensure data is safe for that context.

Which function is best to sanitize a plain text input before saving it?

A sanitize_text_field()

B esc_html()

C esc_attr()

D wp_nonce_field()

sanitize_text_field() cleans plain text input before saving to prevent harmful data.

What is a common sign of an XSS vulnerability in WordPress?

A The admin dashboard is inaccessible

B The site loads slowly

C Images do not display

D User input is shown on the page without escaping

Showing user input without escaping can allow attackers to inject scripts, causing XSS.

Explain how you would prevent XSS attacks when displaying user comments in WordPress.

Think about both input cleaning and output escaping.

Describe the difference between sanitizing and escaping in WordPress and when to use each.

Consider the data flow from user input to display.