I am trying to bypass high security XSS on DVWA. So the vulnerable code(I highly doubt that is it really vulnerable?) is:-


if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){ 

 $isempty = true; 

} else { 

 echo '<pre>'; 
 echo 'Hello ' . htmlspecialchars($_GET['name']); 
 echo '</pre>'; 



And the url is http://localhost/dvwa/vulnerabilities/xss_r/?name=<payload>#

It is clear that application is using htmlspecialchars() which will convert all html characters like <, > into its corresponding html entity. And If I encode my payload

<img src=x onerror=alert(1)>

It will result into

&lt;img src=x onerror=alert(1)&gt;

which will be eventually rendered as

<img src=x onerror=alert(1)>

and also using an event handler is not an option since the user input is rendered within the pre tag and there is no place for adding an attribute.

So what can I do to bypass htmlspecialchars()?

  • you need to decode the char.. i'm sure you gonna make it ;)
    – user226265
    Feb 2, 2020 at 23:33

1 Answer 1


This seems to be from xss_r/source/impossible.php. In the impossible level the vulnerabilities have been fixed, so they are not intended to be vulnerable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.