How can I prevent XSS on a $_POST input?

Question

I already followed the suggestion here and added:

/* Prevent XSS input */
$_GET   = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);
$_POST  = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

to the top of my PHP file. But my question is, is the way I use the $_POST on this required input secure?

if (empty($_POST['number']) || !isset($_POST['number'])) {
    $this->setStatusMessage($translator->translate('please enter your number.'));
    $this->setStatus(KDatabase::STATUS_FAILED);

    return false;
}else{
    $this->telefonnummer = $_POST['number'];
}

Answer 1

Don't think about protecting your inputs to prevent XSS - it should all be about output.

XSS, and other code injection vulnerabilities happen when data is not properly escaped or converted for the context in which it will be used.

How you do that depends on the output technology and context. As AndrolGenhald mentioned in the comments, if you are outputting directly from PHP, without using a templating library, and you want to use a variable in the context of HTML code, then you should pass it through the htmlspecialchars function. With other contexts and technologies the answer will be different. You need to find the correct way to escape data for each context.

If you can make sure you're always escaping data on output correctly, then you shouldn't use FILTER_SANITIZE_STRING. That irreversibly strips various things out of the string, rather than simply making them safe. On a well made website like StackExchange I'm free to submit the code <script>alert('XSS')</script>, and it doesn't get stripped, it just gets encoded so the browser safely displays it instead of executing it.

The code in your question doesn't include any output, so it can't itself be vulnerable to XSS. You need to show code that produces some output if you want to know if it does it safely.