Here is the PHP filter function that I'm dealing with:
function xss_check_2($data)
{
return htmlentities($data, ENT_QUOTES);
}
The source code of the output (the output is the name, Peter Wazinck, at the bottom):
<div id="main">
<h1>HTML Injection - Reflected (GET)</h1>
<p>Enter your first and last name:</p>
<form action="/work/bwapp/bWAPP/htmli_get.php" method="GET">
<p><label for="firstname">First name:</label><br>
<input id="firstname" name="firstname" type="text"></p>
<p><label for="lastname">Last name:</label><br>
<input id="lastname" name="lastname" type="text"></p>
<button type="submit" name="form" value="submit">Go</button>
</form>
<br>
Welcome Steve Wozniak
</div>
Any method to bypass it?
xss_check_2()
) is ever called. Are you sure you're correctly representing the challenge content?