Prevent XSS (Cross-site Scripting) using PHP

A guide on how to prevent XSS (Cross-site Scripting) in PHP by filtering and escaping user input, ensuring website security against XSS vulnerabilities.

<?php
// Function to escape characters to prevent XSS
function escapeXSS($data) {
    return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
}

// Example of handling user input
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Get input from form
    $user_input = $_POST['user_input'];
    
    // Escape special characters to prevent XSS
    $safe_input = escapeXSS($user_input);
    
    // Display the safe input
    echo "Escaped data: " . $safe_input;
}
?>

<!-- User input form -->
<form method="POST">
    <label for="user_input">Enter text:</label>
    <input type="text" id="user_input" name="user_input">
    <input type="submit" value="Submit">
</form>

Detailed explanation:

1. Function escapeXSS():

   • The htmlspecialchars() function is used to escape special characters like &, <, >, " and ', preventing malicious XSS code from being executed when displayed in the browser.
   • The ENT_QUOTES flag ensures both single (') and double (") quotes are escaped, while UTF-8 is specified as the character encoding.

2. Handling user input:

   • When a user submits input via the form, the data is fetched from $_POST['user_input'].
   • The input is then escaped using the escapeXSS() function before being displayed on the webpage, ensuring that no malicious scripts can be executed.

3. Input form:

   • The HTML form allows users to input text and submit it using the POST method. After processing, the input is displayed safely, free from XSS vulnerabilities.

PHP Version:

This code can run on any PHP version from 5.0 and above.