Home/ Questions/Q 4623554
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T03:00:16+00:00

This is my source code: <html> <body> <?php $query = $_REQUEST[search]; Print <iframe src=http://www.en.wikipedia.org/wiki/$query></iframe>’;

  • 0

This is my source code: 

<html>
<body>
<?php

$query = $_REQUEST["search"];

Print "<iframe src="http://www.en.wikipedia.org/wiki/$query"></iframe>';

?>

</body>
</html>

I want to have it where, when the user types in a term, then it automatically brings them to the Wikipedia page of their query. I definitely know I’m doing something wrong here, but I can’t figure out what. Thanks for helping!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    1. Same way you output any variable into HTML text content or attribute values, using htmlspecialchars(). If you don’t do this every time you drop user data into HTML, you’ve got an HTML-injection vulnerability leading to cross-site-scripting (XSS) exploits.

    2. In your case you are inserting a variable into a URL component, so before you HTML-encode, you need to URL-encode, using rawurlencode().

    3. OK… so if you’re doing URL-encoding, you can actually skip the HTML-encoding if you want, because all characters that are special to HTML are also turned into safe % sequences by URL-encoding.

    4. PHP is a templating language. Use it, don’t fight it. Any time you echo or print an interpolated string from inside a PHP block, you’re probably making life unnecessarily hard for yourself.

    Include literal content verbatim and don’t worry about backslash-escaping quote characters in string literals:

    <?php
    $query= $_REQUEST['search'];
?>
<iframe src="http://en.wikipedia.org/wiki/<?php echo rawurlencode($query); ?>">
</iframe>
    • 0