Abbas Naderi: reflected XSS attacks

2013-10-18T19:33:21Z

reflected XSS attacks

New page

To mitigate reflected XSS attacks fully, a PHP code should never output variables using echo, print and other output generating functions. If the output needs to be complex (for example a HTML list of variables) the HTML part should be outside PHP tags, and the rest should be inside and using safe output functions (available in OWASP PHP Security Project Core Library). For example:

<nowiki>
foreach ($list as $item)
{
?>
<li><?php phpsec\exho($item);?></li>
<?php
}
</nowiki>

Or

<nowiki>
foreach ($list as $item)
{
phpsec\printf("<li>%s</li>\n",$item);
}
</nowiki>

CRV2 RevCodeReflectedAntiPatternPHP - Revision history

Abbas Naderi: reflected XSS attacks