My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the
& ... and such characters don't break the XML structure.
So is there a need to have another layer of XSS filter or will this way of saving the data automatically stops XSS attacks.
I'm aware of the fact that this attack depends on lots and lots of other factors such as rendering the webpage but lets confine the discussion to the following code snippet, however since the way I'm going to print the data very from time to time you are free to modify
echo "<h1> Hello ".$name."</h1>" to show me any wrong ways of printing data.
$data = $_POST['malicious_user_supplied_data']; $xml_encoded_data = xml_encode($data); write_to_xml_as($xml_encoded_data,"config.xml"); ------ config.xml -------- <user> <name><script>alert("BigBang")</script></name> </user> -------------------------- $name = get_name("config.xml") // would return <script>alert("BigBang")</script> echo "<h1> Hello ".$name."</h1>" // which on the browser would print <script>alert("BigBang")</script>
Please show me some working examples where the above XML filter can be broken, if there are any.