Cross-site scripting (ARCH7101)

Key php.security.xss · Severity error · Category security · CWE CWE-79

Writing untrusted data to HTML output without escaping lets attackers run scripts in the victim’s browser. Encoding output for its context prevents this.

Incorrect

<?php
$name = $_GET['name'];
echo "<h1>Hello $name</h1>";

Correct

<?php
$name = $_GET['name'];
$safe = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
echo "<h1>Hello $safe</h1>";

Fix

Encode untrusted data for its context with htmlspecialchars() before writing it to HTML.