Here is the PHP filter function that I'm dealing with:

function xss_check_2($data)
    return htmlentities($data, ENT_QUOTES);

The source code of the output (the output is the name, Peter Wazinck, at the bottom):

<div id="main">

<h1>HTML Injection - Reflected (GET)</h1>

<p>Enter your first and last name:</p>

<form action="/work/bwapp/bWAPP/htmli_get.php" method="GET">

    <p><label for="firstname">First name:</label><br>
    <input id="firstname" name="firstname" type="text"></p>

    <p><label for="lastname">Last name:</label><br>
    <input id="lastname" name="lastname" type="text"></p>

    <button type="submit" name="form" value="submit">Go</button>  


Welcome Steve Wozniak

Any method to bypass it?

  • You're trying to solve bWAPP's GET XSS challenge. This challenge supports different security levels all of which call a different filter function. However with none of the security levels the filter you're giving here (xss_check_2()) is ever called. Are you sure you're correctly representing the challenge content?
    – Arminius
    Dec 21, 2017 at 20:34

2 Answers 2


From the context you provided, this filter appears safe.

Your output is in the data state (outside of any tags or attribute values). Therefore an attacker would need to inject at least an opening angle bracket (<) to introduce new HTML code.

Since htmlentities() converts all opening angle brackets to their HTML entity representation (&lt;), there is no obvious way to bypass the filter.

  • 1
    Although you say the filter is safe , it's implemented in an intentionally vulnerable application and the application's developer says you can bypass this filter
    – Yacine
    Dec 21, 2017 at 20:25
  • @Yacine That's why I qualified my answer with "from the context you provided". I'll have a look at the challenge myself and let you know.
    – Arminius
    Dec 21, 2017 at 20:28

In the bWAPP application there are 2 sets (3 sets really) of XSS protections. Level 2 and Level 3.

function xss_check_2($data)

    // htmlentities - converts all applicable characters to HTML entities

    return htmlentities($data, ENT_QUOTES);


function xss_check_3($data, $encoding = "UTF-8")
    // htmlspecialchars - converts special characters to HTML entities    
    // '&' (ampersand) becomes '&amp;' 
    // '"' (double quote) becomes '&quot;' when ENT_NOQUOTES is not set
    // "'" (single quote) becomes '&#039;' (or &apos;) only when ENT_QUOTES is set
    // '<' (less than) becomes '&lt;'
    // '>' (greater than) becomes '&gt;'  

    return htmlspecialchars($data, ENT_QUOTES, $encoding);


If you look at the level 3 filters they are setting the $encoding to UTF-8 which invalidates UTF-7 and other types of encodings. You may want to search the other encodings in Level 2 to see if you can find a filter bypass that works for you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .