A recent scan of Acunetix has shown some vulnerability on one of my pages. I tried reproducing it but i can not find any vulnerability. The so called vulnerably is titled The input is reflected inside a tag parameter between double quotes mean.

The scan gives me the following result for my page.

Details URL encoded GET input afficher_forgot_password was set to **Oui"sTYLe='acu:Expre/**/SSion(Afih(9717))'bad="**
The input is reflected inside a tag parameter between double quotes.

Request headersGET /verif.php?afficher_forgot_password=Oui"sTYLe='acu:Expre/**/SSion(Afih(9717))'bad="&lang_abbreviation=en&membre= HTTP/1.1
 Connection: keep-aliveCookie: PHPSESSID=feef28e9052ce51f6701e34749ca30ac;lang_abbreviation=enAccept: */*Accept-Encoding: gzip, User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, likeGecko) Chrome/73.0.3683.103 Safari/537.36

Here is a direct link that reproduces the so called vulnerability but I do not see any vulnerability on the page. what does The input is reflected inside a tag parameter between double quotes mean ?


Acunetix system was able to inject


in your url and it is reflecting in your html code output. You should parse everything that is in double code especially special characters that is not normally used in url such as quote, double quote, stars... especially those that can affect an Sql Database.

You can clean your code using the two functions below which helped me personally in the past :

//Remove programming characters
function enlever_programmation($membre)
    $to_replace = array("`", "`", "!", "#", '$', "%", "^", "*",  "(", ")", "{", "}", "[", "]", "|",  "'", '"', "<", ">");
    $membre = str_replace($to_replace, '', $membre);
    $membre = stripslashes($membre);
    $membre = filter_var($membre, FILTER_SANITIZE_STRING);
    $membre = str_replace('%', '?', $membre);
    $membre = str_replace('??', '?', $membre);
    return $membre;

function clean_url($url)
    list($url) = explode("*", $url, 2);
    list($url) = explode("%", $url, 2);
    list($url) = explode("'", $url, 2);
    list($url) = explode('"', $url, 2); 
    $url = enlever_programmation($url);     
    return $url;

So you can apply the code to your url or string as follow :

$string = clean_url($string);

That way any code Acunetix will try to inject into your Html via URL will not reflect any double quote or sql injection in your source. This will mostly help prevent xss attack however for sql injection you will have to add prepared statement to make it complete.

| improve this answer | |
  • 4
    PLEASE don't use this in production. This looks like one of those "do everything possible to make the string safe" kinds of functions, which typically come with far more downsides than benefits. A simple strip_tags and html_entities will accomplish the same, without the unpredictable side effects. For instance, let's hope you're not Irish: $string = clean_url('O\'Brian') Outputs: O. That's going to confuse a LOT of people. – Conor Mancone Aug 8 '19 at 21:43
  • 3
    Also downvoting since this is probably not a good/safe solution. – multithr3at3d Aug 8 '19 at 22:06

What happened?

The vulnerability scanner thinks that it found a possible reflective XSS or HTML injection vulnerability in the page.

When it injected Oui"sTYLe='acu:Expre/**/SSion(Afih(9717))'bad=" as a GET request parameter, the page rendered with the following element in it:

<a href="https://trojanmart.com/SSionAfih9717" title="Français " class=" ">...</a>

Part of the content (SSionAfih9717) matched the injected data.

Should you be concerned?

It depends. Tests like this may often be a false positive, as there are many different scenarios where user-input text may be reflected in the page in a non-harmful way.

It looks like the test was trying to inject a HTML attribute named bad into whatever element contained the data, but the word "bad" doesn't appear anywhere in the resultant HTML. I believe a successful attempt may have looked something like this:

<a href="https://trojanmart.com/SSionAfih9717" bad= title="Français " class=" ">...</a>

Note how the attribute bad appears after href. This could be used by an attacker to inject arbitrary JavaScript or manipulate the page in other ways.

In your particular case, you don't seem to be affected by the test, and it can likely be considered a false positive. That said, there may be other scenarios you are vulnerable to, as this is just one test of many possible. That said, if the request could completely replace the href value instead of being added at the end, it could be used to target javascript: URIs or other domains in the attacker's control.

How to fix it?

If you were really vulnerable to this, you would want to follow best practices outlined in the OWASP XSS Prevention Cheat Sheet Rule #5:

RULE #5 - URL Escape Before Inserting Untrusted Data into HTML URL Parameter Values

Rule #5 is for when you want to put untrusted data into HTTP GET parameter value.

<a href="http://www.somesite.com?test=...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...">link</a > 

Except for alphanumeric characters, escape all characters with ASCII values less than 256 with the %HH escaping format. Including untrusted data in data: URLs should not be allowed as there is no good way to disable attacks with escaping to prevent switching out of the URL.

All attributes should be quoted. Unquoted attributes can be broken out of with many characters including [space] % * + , - / ; < = > ^ and |. Note that entity encoding is useless in this context.

WARNING: Do not encode complete or relative URL's with URL encoding! If untrusted input is meant to be placed into href, src or other URL-based attributes, it should be validated to make sure it does not point to an unexpected protocol, especially javascript links. URL's should then be encoded based on the context of display like any other piece of data. For example, user driven URL's in HREF links should be attribute encoded.

For example:

String userURL = request.getParameter( "userURL" )
boolean isValidURL = Validator.IsValidURL(userURL, 255); 
if (isValidURL) {  
    <a href="<%=encoder.encodeForHTMLAttribute(userURL)%>">link</a>
| improve this answer | |
  • Can you please give me the same thing in Php ? I am a Php Programmer – Man Of God Aug 9 '19 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.