Question

Let’s say we have this form, and the possible part for a user to inject malicious code is this below

...
<input type=text name=username value=
       <?php echo htmlspecialchars($_POST['username']); ?>>
...

We can’t simply put a tag, or a javascript:alert(); call, because value will be interpreted as a string, and htmlspecialchars filters out the <,>,’,”, so We can’t close off the value with quotations.

We can use String.fromCode(…..) to get around the quotes, but I still unable to get a simple alert box to pop up.

Any ideas?

Answer 1

Also, it’s important to mention that allowing people to inject HTML or JavaScript into your page (and not your datasource) carries no inherent security risk itself. There already exist browser extensions that allow you to modify the DOM and scripts on web pages, but since it’s only client-side, they’re the only ones that will know.

Where XSS becomes a problem is when people a) use it to bypass client-side validation or input filtering or b) when people use it to manipulate input fields (for example, changing the values of OPTION tags in an ACL to grant them permissions they shouldn’t have). The ONLY way to prevent against these attacks is to sanitize and validate input on the server-side instead of, or in addition to, client-side validation.

For sanitizing HTML out of input, htmlspecialchars is perfectly adequate unless you WANT to allow certain tags, in which case you can use a library like HTMLPurifier. If you’re placing user input in HREF, ONCLICK, or any attribute that allows scripting, you’re just asking for trouble.

EDIT: Looking at your code, it looks like you aren’t quoting your attributes! That’s pretty silly. If someone put their username as:

john onclick="alert('hacking your megabits!1')"

Then your script would parse as:

<input type=text name=username value=john onclick="alert('hacking your megabits!1')">

ALWAYS use quotes around attributes. Even if they aren’t user-inputted, it’s a good habit to get into.

<input type="text" name="username" value="<?php echo htmlspecialchars($_POST['username']); ?>">