This depends on the context. I am assuming you're using htmlentities()
function, which would be generally safe. It does more or less the exact same thing as htmlspecialchars()
does.
Both of which secure against general XSS, and prevent event-based XSS when the sanitized parameter is injected into a HTML tag.
They both do not prevent javascript:
attacks, which can happen if injecting the parameter value into a link, iframe, or other similar tag. If injecting a src
or href
from any of them tags, I would recommend first removing any whitespace from the parameter, and then checking for both javascript:
and data:
.
javascript:alert(0)
will give you an alert when injected into a link or iframe.
data:text/javascript:alert(0)
will do the same.
data:text/html:<script>alert(0);</script>
does the same thing too, and bypasses strip_tags
.
The reason for first removing whitespace, is to prevent an attacker dropping a line break/CRLF character in the middle of their payload, so PHP reads it as not being javascript:
or data:
when blocking the payload, but it will still execute as javascript will ignore it.
I hope that explains what type of attacks are possible, it's very easy to claim that htmlentities()
and htmlspecialchars()
are a one-fits-all solution to the problem, but depending on the situation, that can be extremely dangerous advice.