I just wrote this function to parse strings and prevent XSS:

  function tep_sanitize_string($string) {
    $patterns = array ('/ +/','/[<>]/');
    $replace = array (' ', '_');
    return preg_replace($patterns, $replace, trim($string));

Is there any way to bypass this filter? P.S.: In my application the $string will never takes place into src="" parameters or similar.

  • use%20of%20url%20encoded%20strings%3A%2F%3F%5B%3C%3E%5D Commented Jan 12, 2017 at 15:11
  • No way, input is sanitized successfully.
    – user136149
    Commented Jan 12, 2017 at 15:19

1 Answer 1


If your security is based on "in my application common use case X will never happen", it will likely fail.

First of, input sanitation is not the correct approach to XSS, context dependent encoding is.

Your approach is also overly complex. Why do you filter space and +? Why replace < and > with _, but the others with space?

Your approach is also not very user-friendly. < and > are used legitimately all the time, as is +.

All that being said, no, in a plain HTML context - not in a HTML attribute context, CSS or JS context, etc - XSS cannot take place without < and >, so there would be no way to bypass the filter. In other contexts, XSS can still happen. Even if you don't currently put user input in other contexts, you or another developer will do so in the future. And they will just assume that a function called tep_sanitize_string will be secure here as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .