XSS attack still works despite htmlspecialchars() doing its work

Question

hi i am trying to filter outputs of users who will put free text and wanna prevent XSS attacks so i tried this function i made to check

",
    "javascript:/*-->\"\>",
    "javascript:alert(String.fromCharCode(88,83,83))",
    "# onmouseover=\"alert('xxs')\"",
    " onmouseover=\"alert('xxs')\"",
    "x onerror=\"javascript:alert('XSS')\"",
    "javascript:alert('XSS')",
    "javascript:alert('XSS')",
    "javascript:alert('XSS')",
    "jav    ascript:alert('XSS');",
    "jav	ascript:alert('XSS');",
    "jav
ascript:alert('XSS');",
    "javascript:alert('XSS');",
    "",
    "   javascript:alert('XSS');",
    "",
    "",
    "",
    "<",
    "

user_1422370 · Answer

You can't sanitize all type of XSS with htmlspecialchars. htmlspecialchars may help you to protect against XSS inside HTML tags or some quoted HTML attributes.

You have to sanitize the different type of XSS with their own sanitization method.

User input placed inside HTML:

Attack vector:

This type of XSS can be sanitized using htmlspecialchars function because attacker need to use < and > to create new HTML tag.

Solution:

User input placed inside single quoted attribute:

Attack vector: ' onload='alert(1)' '

htmlspecialchars will not encode single quote ' by default. You must turn it on using ENT_QUOTES option.

Solution:

User input placed inside URL attributes: src, href, formaction, ...

    
    
    Link

Attack vector: javascript:alert(1), javscript://alert(1)

htmlspecialchars Document

This function will not prevent those vectors because they haven't any HTML special character. To prevent such attacks, you need to validate input as a URL.

Solution:

User input placed inside JavaScript tag without any quote

Attack vector: 1;alert(1)

in some cases, we can easily quote input and prevent attack by sanitizing it using htmlspecialchars but if we need input to be integer we can prevent XSS by using input validation.

Solution:

Always quote variables when it placed inside a HTML attribute and do a proper sanitization.

XSS attack still works despite htmlspecialchars() doing its work

1 Answers