Question

I have this php code and my CMS security auto-test says it’s a XSS attack. Why and How can I fix this?

$url = "news.php";
if (isset($_GET['id']))
  $url .= "?id=".$_GET["id"];
echo "<a href='{$url}'>News</a>";

Answer 1

It’s XSS (cross site scripting) as someone could call your thing like this:

?id='></a><script type='text/javascript'>alert('xss');</script><a href='

Essentially turning your code into

<a href='news.php?id='></a><script type='text/javascript'>alert('xss');</script><a href=''>News</a>

Now whenever someone would visit this site, it’d load and run the javascript alert('xss'); which might as well be a redirector or a cookie stealer.

As many others have mentioned, you can fix this by using filter_var or intval (if it’s a number). If you want to be more advanced, you could also use regex to match your string.

Imagine you accept a-z A-Z and 0-9. This would work:

if (preg_match("/^[0-9a-zA-Z]+$", $_GET["id"])) {
    //whatever
}

filter_input even has a manual entry doing exactly what you want (sanitizing your input into a link):

<?php
    $search_html = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_SPECIAL_CHARS);
    $search_url = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_ENCODED);
    echo "You have searched for $search_html.\n";
    echo "<a href='?search=$search_url'>Search again.</a>";
?>