Home/ Questions/Q 6892865
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T06:35:15+00:00

I have a webpage with a query string. In PHP I have: $querystring=$_SERVER[QUERY_STRING]; echo

  • 0

I have a webpage with a query string.

In PHP I have:

$querystring=$_SERVER["QUERY_STRING"];
echo "<html><head></head><body>
<a href='index.php?$querystring'>test</a>
</body></html>";

Do I need to sanitize the querystring?
If yes, how do I sanitize and what are some possible attacks if I don’t?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You should use htmlspecialchars($query, ENT_QUOTES) to prevent any XSS attacks.

    echo "<html><head></head><body>
<a href='index.php?".htmlspecialchars($querystring, ENT_QUOTES)."'>test</a>
</body></html>"

    But still, you should white list any parameters, because a smart attacker could forge a query and attempt a CSRF attack.

    • 0