So you all know about the XSS vulnerability but what I cannot understand is
how come injecting a <?php ?> tag doesn't work? eg.:
suppose there is a Stored XSS vulnerability in the index.php of a site why it doesn't work if you did this:
1. close the php tag ?>
2.open a new one <?php
3.inject your php code and close it again

closed as off-topic by rook, Adi, TildalWave, schroeder, Rory Alsop Oct 2 '14 at 15:00

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – rook, TildalWave, schroeder, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    XSS = interpreted on client side. Clients don't deal/understand PHP. To inject dynamic PHP would be possible in very very very specific contexts and XSS are completely unrelated to this – Aki Oct 2 '14 at 2:03

Because the index.php file is already being processed. When you attempt to inject a ?> tag into the file, you're actually injecting it into the page that will eventually be sent to the client.

Not the answer you're looking for? Browse other questions tagged or ask your own question.