XSS prevention in Wordpress - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does XSS stand for and why is it dangerous in WordPress?

XSS stands for Cross-Site Scripting. It is dangerous because attackers can inject harmful scripts into web pages viewed by other users, stealing data or hijacking sessions.

beginner

Which WordPress function should you use to safely output data in HTML to prevent XSS?

Use esc_html() to safely output data inside HTML content, escaping harmful characters to prevent XSS.

intermediate

How does esc_attr() help in XSS prevention?

esc_attr() escapes data before placing it inside HTML attributes, stopping attackers from injecting scripts via attributes.

beginner

Why should you never trust user input directly in WordPress?

User input can contain malicious code. Always sanitize and escape it before use to prevent XSS and other attacks.

intermediate

What is the difference between sanitizing and escaping in WordPress XSS prevention?

Sanitizing cleans input data before saving it. Escaping cleans data before outputting it. Both protect against XSS but at different stages.

Which WordPress function escapes data for safe use inside HTML attributes?

A esc_html()

B esc_attr()

C sanitize_text_field()

D wp_kses()

esc_attr() is used to escape data inside HTML attributes to prevent XSS.

What is the main purpose of wp_kses() in WordPress?

A To sanitize input by allowing only certain HTML tags

B To escape data for JavaScript output

C To encrypt user passwords

D To minify CSS files

wp_kses() filters input to allow only safe HTML tags, helping prevent XSS.

When should you escape data in WordPress to prevent XSS?

A Only when receiving data from the user

B Only when saving data to the database

C Right before outputting it to the browser

D Never, WordPress does it automatically

Escaping should happen right before output to ensure data is safe for that context.

Which function is best to sanitize a plain text input before saving it?

A sanitize_text_field()

B esc_html()

C esc_attr()

D wp_nonce_field()

sanitize_text_field() cleans plain text input before saving to prevent harmful data.

What is a common sign of an XSS vulnerability in WordPress?

A The admin dashboard is inaccessible

B The site loads slowly

C Images do not display

D User input is shown on the page without escaping

Showing user input without escaping can allow attackers to inject scripts, causing XSS.

Explain how you would prevent XSS attacks when displaying user comments in WordPress.

Think about both input cleaning and output escaping.

Describe the difference between sanitizing and escaping in WordPress and when to use each.

Consider the data flow from user input to display.

Practice

1. What is the main purpose of XSS prevention in WordPress?

easy

A. To improve SEO rankings

B. To speed up website loading time

C. To stop harmful scripts from running on your website

D. To add more images to your site

Solution

1. Step 1: Understand what XSS means

   XSS stands for Cross-Site Scripting, which allows attackers to run harmful scripts on your site.

2. Step 2: Identify the goal of prevention

   The goal is to stop these harmful scripts from running to protect users and the site.

3. Final Answer:

   To stop harmful scripts from running on your website -> Option C

4. Quick Check:

   XSS prevention = stop harmful scripts [OK]

Hint: XSS prevention blocks bad scripts from running [OK]

Common Mistakes:

• Thinking XSS prevention improves speed
• Confusing XSS with SEO improvements
• Believing it adds content automatically

2. Which WordPress function is used to safely escape text before outputting it to prevent XSS?

easy

A. esc_html()

B. wp_kses_post()

C. sanitize_text_field()

D. wp_enqueue_script()

Solution

1. Step 1: Identify escaping functions for output

   esc_html() escapes text for safe HTML output, preventing scripts from running.

2. Step 2: Differentiate from other functions

   wp_kses_post() allows some HTML, sanitize_text_field() cleans input, wp_enqueue_script() loads scripts.

3. Final Answer:

   esc_html() -> Option A

4. Quick Check:

   Escape text output = esc_html() [OK]

Hint: Use esc_html() to escape text output safely [OK]

Common Mistakes:

• Using sanitize_text_field() for output escaping
• Confusing wp_kses_post() with esc_html()
• Thinking wp_enqueue_script() escapes text

3. What will be the output of this code snippet if user input is <script>alert('XSS')</script>?

<?php
echo esc_html($_GET['input']);
?>

medium

A. PHP error

B. (runs alert)

C. Empty output

D. <script>alert('XSS')</script> (shown as text)

Solution

1. Step 1: Understand esc_html() effect

   esc_html() converts special HTML characters to safe text, so tags show as text, not code.

2. Step 2: Predict output with given input

   The script tags will be shown as <script>alert('XSS')</script> literally, not executed.

3. Final Answer:

   <script>alert('XSS')</script> (shown as text) -> Option D

4. Quick Check:

   esc_html() escapes tags to text [OK]

Hint: esc_html() shows tags as text, not code [OK]

Common Mistakes:

• Thinking script runs despite escaping
• Expecting empty output
• Assuming PHP error occurs

4. Identify the error in this code that tries to prevent XSS:

<?php
$user_input = $_POST['comment'];
echo $user_input;
?>

medium

A. Missing escaping function before echoing user input

B. Using $_POST instead of $_GET

C. Variable name is incorrect

D. No error, code is safe

Solution

1. Step 1: Check how user input is output

   The code echoes raw user input without escaping, which can run harmful scripts.

2. Step 2: Identify missing security step

   It should use an escaping function like esc_html() before echoing to prevent XSS.

3. Final Answer:

   Missing escaping function before echoing user input -> Option A

4. Quick Check:

   Always escape user output [OK]

Hint: Always escape user data before echoing [OK]

Common Mistakes:

• Thinking $_POST vs $_GET matters here
• Believing variable name causes error
• Assuming raw echo is safe

5. You want to allow some HTML tags like <strong> and <a> in user comments but prevent scripts. Which WordPress function should you use?

hard

A. sanitize_text_field()

B. wp_kses()

C. esc_html()

D. wp_strip_all_tags()

Solution

1. Step 1: Understand the need to allow some HTML safely

   esc_html() escapes all HTML, sanitize_text_field() removes tags, wp_strip_all_tags() removes all tags.

2. Step 2: Identify function that allows specific tags

   wp_kses() lets you specify allowed tags and attributes, filtering out harmful scripts but keeping safe HTML.

3. Final Answer:

   wp_kses() -> Option B

4. Quick Check:

   Allow safe HTML = wp_kses() [OK]

Hint: Use wp_kses() to allow safe HTML tags only [OK]

Common Mistakes:

• Using esc_html() which escapes all tags
• Using sanitize_text_field() which removes tags
• Assuming wp_strip_all_tags() allows some HTML