So obviously you would do html_entities() with the ENT_QUOTES flag right before it is being outputted, but I still have a feel that other languages like JavaScript and PHP are not taken care of. What else do I need to be doing when I access the row from the database?

This helps a little, but it does not disuss server-side languages https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet.

  • That's very broad question. You mention accessing rows in database, outputting text, javascript, php and XSS. Is there something in particular you need to solve? – Aria Aug 5 '16 at 21:37
  • I think my problem is outputting the text – lazyboy78 Aug 5 '16 at 23:27

htmlentities is sufficient to protect your site and your visitors as long as you don't do anything overtly ignorant in the process. For example, let's say you output the message like this:

<div class="post"><?php echo htmlentities($myVar, ENT_QUOTES); ?></div> ...

Since everything is escaped, you'll be okay, even if PHP or JavaScript is in $myVar. However, this does not apply if you decide to do something like this:

<script><?php echo htmlentities($myVar, ENT_QUOTES); ?></script>

Because that's a valid mode for JavaScript to be encoded in, and it would result in the execution of the script. Similarly, PHP doesn't ordinarily execute just because it runs into PHP escapes within a string, so htmlentities causes no harm, unless you decide to:

<?php eval($myVar); ?>

Preventing XSS isn't just about escaping output, it's about knowing when to escape output, and in which contexts it might be dangerous. You should never emit user input within a script, style, base or link tag, and you should always sanitize user input before putting it anywhere in the body or head tag or any of its children, and especially in attributes, which is common when you're pre-populating forms (e.g. so they can correct invalid input).

Even the site you linked to contains basically what I just said, but less verbose:

HTML entity encoding is okay for untrusted data that you put in the body of the HTML document, such as inside a tag. It even sort of works for untrusted data that goes into attributes, particularly if you're religious about using quotes around your attributes. But HTML entity encoding doesn't work if you're putting untrusted data inside a tag anywhere, or an event handler attribute like onmouseover, or inside CSS, or in a URL. So even if you use an HTML entity encoding method everywhere, you are still most likely vulnerable to XSS. You MUST use the escape syntax for the part of the HTML document you're putting untrusted data into. That's what the rules below are all about.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.