XSS prevention in Wordpress - Step-by-Step Execution

Concept Flow - XSS prevention

User Input Received

↓

Sanitize Input

↓

Store or Process Data

↓

Escape Output Before Display

↓

Safe Content Rendered in Browser

↓

User Sees Clean, Safe Page

This flow shows how WordPress handles user input by sanitizing it first, then escaping output before showing it to users to prevent XSS attacks.

Execution Sample

Wordpress

<?php
$input = $_POST['comment'];
$clean_input = sanitize_text_field($input);
echo esc_html($clean_input);
?>

This code takes user comment input, cleans it to remove harmful code, then safely shows it on the page.

Execution Table

Step	Action	Input/Variable	Result/Output
1	Receive user input	User types: <script>alert('XSS')</script>	<script>alert('XSS')</script>
2	Sanitize input with sanitize_text_field()	<script>alert('XSS')</script>	alert('XSS')
3	Escape output with esc_html()	alert('XSS')	alert(&#039;XSS&#039;)
4	Render output in browser	alert(&#039;XSS&#039;)	Displays text: alert('XSS') safely, no script runs
5	End	N/A	Safe content shown, no XSS executed

💡 User input is sanitized and escaped, so no harmful script runs in the browser.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
$input	undefined	<script>alert('XSS')</script>	<script>alert('XSS')</script>	<script>alert('XSS')</script>	<script>alert('XSS')</script>
$clean_input	undefined	undefined	alert('XSS')	alert('XSS')	alert('XSS')
Output	undefined	undefined	undefined	alert(&#039;XSS&#039;)	alert(&#039;XSS&#039;)

Key Moments - 2 Insights

Why do we need both sanitize_text_field() and esc_html()?

sanitize_text_field() cleans the input to remove harmful code before storing or processing, while esc_html() escapes output to prevent any remaining code from running in the browser. Both steps together stop XSS attacks, as shown in steps 2 and 3 of the execution_table.

What happens if we skip esc_html() and just echo sanitized input?

Even sanitized input might contain characters that browsers interpret as code. Without esc_html(), the browser could run scripts. The execution_table step 4 shows escaping output is crucial to display safe text.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of $clean_input after sanitization (step 2)?

A <script>alert('XSS')</script>

B alert(&#039;XSS&#039;)

C alert('XSS')

D undefined

💡 Hint

Check the 'Result/Output' column at step 2 in the execution_table.

At which step does the output become safe to display in the browser?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look for when esc_html() is applied in the execution_table.

If we remove sanitize_text_field(), how would the $clean_input value change at step 2?

A It would be empty string

B It would still be <script>alert('XSS')</script>

C It would be alert('XSS')

D It would be escaped HTML

💡 Hint

Sanitize function removes tags; without it, input stays raw as in step 1.

Concept Snapshot

XSS Prevention in WordPress:
- Sanitize input with sanitize_text_field() to clean user data.
- Escape output with esc_html() before showing on page.
- Both steps stop harmful scripts from running.
- Always sanitize first, then escape.
- Prevents attackers injecting malicious code.

Full Transcript

This visual execution shows how WordPress prevents cross-site scripting (XSS) attacks. First, user input is received as raw text, which may contain harmful scripts. Then, sanitize_text_field() cleans the input by removing HTML tags and dangerous code. Next, esc_html() escapes special characters so the browser treats them as text, not code. Finally, the safe content is displayed on the page. This two-step process ensures no malicious scripts run, protecting users from XSS vulnerabilities.