XSS prevention in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely output a user input in WordPress.

Wordpress

<?php echo [1]($_GET['user_input']); ?>

Drag options to blanks, or click blank then click option'

Aprint_r

Besc_html

Cvar_dump

Dhtmlspecialchars_decode

Attempts:

3 left

💡 Hint

Common Mistakes

Using print_r or var_dump which do not escape output

Using htmlspecialchars_decode which decodes entities

Use esc_html to safely escape HTML characters and prevent XSS.

2fill in blank

medium

Complete the code to sanitize a text input before saving in WordPress.

Wordpress

$safe_text = [1]($_POST['comment']);

Drag options to blanks, or click blank then click option'

Asanitize_email

Bwp_kses_post

Csanitize_text_field

Desc_url

Attempts:

3 left

💡 Hint

Common Mistakes

Using sanitize_email for non-email input

Using esc_url which is for URLs

sanitize_text_field cleans text input by stripping tags and harmful content.

3fill in blank

hard

Fix the error in escaping a URL output in WordPress.

Wordpress

<a href="[1]($url)">Link</a>

Drag options to blanks, or click blank then click option'

Aesc_url

Besc_url_raw

Cesc_html

Dsanitize_text_field

Attempts:

3 left

💡 Hint

Common Mistakes

Using esc_html which is for HTML content, not URLs

Using esc_url_raw which is for saving URLs, not output

esc_url properly escapes URLs for safe output in HTML attributes.

4fill in blank

hard

Fill both blanks to allow safe HTML tags in user input and output it.

Wordpress

<?php $allowed_tags = [1](); echo [2]($user_input, $allowed_tags); ?>

Drag options to blanks, or click blank then click option'

Awp_kses_allowed_html

Besc_html

Cwp_kses

Dsanitize_text_field

Attempts:

3 left

💡 Hint

Common Mistakes

Using esc_html which escapes all HTML

Using sanitize_text_field which strips all tags

wp_kses_allowed_html returns allowed HTML tags, and wp_kses filters input to allow only those tags.

5fill in blank

hard

Fill all three blanks to create a safe attribute output with a default fallback.

Wordpress

<?php $title = isset($data['title']) ? [1]($data['title']) : [2]; echo '<h1 title="' . [3]($title) . '">' . $title . '</h1>'; ?>

Drag options to blanks, or click blank then click option'

Asanitize_text_field

B"Default Title"

Cesc_attr

Desc_html

Attempts:

3 left

💡 Hint

Common Mistakes

Not escaping attribute output

Using esc_html instead of esc_attr for attributes

sanitize_text_field cleans the input, "Default Title" is fallback text, and esc_attr safely escapes the attribute.

Practice

1. What is the main purpose of XSS prevention in WordPress?

easy

A. To improve SEO rankings

B. To speed up website loading time

C. To stop harmful scripts from running on your website

D. To add more images to your site

Solution

1. Step 1: Understand what XSS means

   XSS stands for Cross-Site Scripting, which allows attackers to run harmful scripts on your site.

2. Step 2: Identify the goal of prevention

   The goal is to stop these harmful scripts from running to protect users and the site.

3. Final Answer:

   To stop harmful scripts from running on your website -> Option C

4. Quick Check:

   XSS prevention = stop harmful scripts [OK]

Hint: XSS prevention blocks bad scripts from running [OK]

Common Mistakes:

• Thinking XSS prevention improves speed
• Confusing XSS with SEO improvements
• Believing it adds content automatically

2. Which WordPress function is used to safely escape text before outputting it to prevent XSS?

easy

A. esc_html()

B. wp_kses_post()

C. sanitize_text_field()

D. wp_enqueue_script()

Solution

1. Step 1: Identify escaping functions for output

   esc_html() escapes text for safe HTML output, preventing scripts from running.

2. Step 2: Differentiate from other functions

   wp_kses_post() allows some HTML, sanitize_text_field() cleans input, wp_enqueue_script() loads scripts.

3. Final Answer:

   esc_html() -> Option A

4. Quick Check:

   Escape text output = esc_html() [OK]

Hint: Use esc_html() to escape text output safely [OK]

Common Mistakes:

• Using sanitize_text_field() for output escaping
• Confusing wp_kses_post() with esc_html()
• Thinking wp_enqueue_script() escapes text

3. What will be the output of this code snippet if user input is <script>alert('XSS')</script>?

<?php
echo esc_html($_GET['input']);
?>

medium

A. PHP error

B. (runs alert)

C. Empty output

D. <script>alert('XSS')</script> (shown as text)

Solution

1. Step 1: Understand esc_html() effect

   esc_html() converts special HTML characters to safe text, so tags show as text, not code.

2. Step 2: Predict output with given input

   The script tags will be shown as <script>alert('XSS')</script> literally, not executed.

3. Final Answer:

   <script>alert('XSS')</script> (shown as text) -> Option D

4. Quick Check:

   esc_html() escapes tags to text [OK]

Hint: esc_html() shows tags as text, not code [OK]

Common Mistakes:

• Thinking script runs despite escaping
• Expecting empty output
• Assuming PHP error occurs

4. Identify the error in this code that tries to prevent XSS:

<?php
$user_input = $_POST['comment'];
echo $user_input;
?>

medium

A. Missing escaping function before echoing user input

B. Using $_POST instead of $_GET

C. Variable name is incorrect

D. No error, code is safe

Solution

1. Step 1: Check how user input is output

   The code echoes raw user input without escaping, which can run harmful scripts.

2. Step 2: Identify missing security step

   It should use an escaping function like esc_html() before echoing to prevent XSS.

3. Final Answer:

   Missing escaping function before echoing user input -> Option A

4. Quick Check:

   Always escape user output [OK]

Hint: Always escape user data before echoing [OK]

Common Mistakes:

• Thinking $_POST vs $_GET matters here
• Believing variable name causes error
• Assuming raw echo is safe

5. You want to allow some HTML tags like <strong> and <a> in user comments but prevent scripts. Which WordPress function should you use?

hard

A. sanitize_text_field()

B. wp_kses()

C. esc_html()

D. wp_strip_all_tags()

Solution

1. Step 1: Understand the need to allow some HTML safely

   esc_html() escapes all HTML, sanitize_text_field() removes tags, wp_strip_all_tags() removes all tags.

2. Step 2: Identify function that allows specific tags

   wp_kses() lets you specify allowed tags and attributes, filtering out harmful scripts but keeping safe HTML.

3. Final Answer:

   wp_kses() -> Option B

4. Quick Check:

   Allow safe HTML = wp_kses() [OK]

Hint: Use wp_kses() to allow safe HTML tags only [OK]

Common Mistakes:

• Using esc_html() which escapes all tags
• Using sanitize_text_field() which removes tags
• Assuming wp_strip_all_tags() allows some HTML