Cross-Site Scripting (XSS)

Also Known As

TL;DR

Explanation

XSS lets attackers inject JavaScript into pages viewed by other users. Reflected XSS triggers via a crafted URL; stored XSS persists in the database and fires for every visitor. Consequences include session hijacking, credential theft, keylogging, and full account takeover. Prevention requires context-aware output encoding — in PHP, htmlspecialchars() with ENT_QUOTES for HTML contexts, and different escaping for JS, CSS, and URL contexts.

How It's Exploited

Diagram

flowchart TD
    ATK[Attacker] -->|stores script| DB[(Database<br/>or URL param)]
    VICTIM[Victim visits page] --> SERVER[Server renders<br/>unescaped output]
    SERVER -->|script in HTML| BROWSER[Browser executes<br/>attacker script]
    BROWSER -->|steal cookie| ATK
    BROWSER -->|keylog form| ATK
    subgraph Fix
        OUT[Output] --> ESC[htmlspecialchars<br/>Content-Security-Policy]
        ESC --> SAFE[Inert text<br/>not executed]
    end
style LEAK fill:#f85149,color:#fff
style SAFE fill:#238636,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Encoding input on the way in rather than on output — context determines the correct encoding, not the storage layer.
• Forgetting that HTML encoding is wrong inside JavaScript contexts — you need JS encoding there.
• Trusting htmlspecialchars() without ENT_QUOTES — single quotes in attributes remain dangerous.
• Marking user content as safe in templating engines (e.g. {!! $var !!} in Blade) without explicit sanitisation.

Avoid When

• Do not rely on input sanitisation alone — stripping tags on input does not prevent XSS on output.
• Do not use htmlspecialchars() for JavaScript, URL, or CSS contexts — each context requires its own escaping function.

When To Use

• Understanding XSS is essential for any developer rendering user-supplied content in a browser.
• Apply output encoding whenever displaying data from any untrusted source — database, API, user input.

Code Examples

// Reflected XSS — user input echoed directly
echo '<p>Hello, ' . $_GET['name'] . '</p>';

// Always escape output for the correct context
echo '<p>Hello, ' . htmlspecialchars($_GET['name'] ?? '', ENT_QUOTES, 'UTF-8') . '</p>';

// For JS context, json_encode is the correct escaper:
$data = json_encode($userInput, JSON_HEX_TAG | JSON_HEX_AMP);

References

• ↗ https://owasp.org/www-community/attacks/xss/
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• ↗ https://cwe.mitre.org/data/definitions/79.html

Tags

Related Terms