To prevent XSS attacks in PHP, sanitize input and escape output based on context. 1. Sanitize user input using PHP’s filter_var() function or HTML Purifier for HTML content. 2. Escape output with htmlspecialchars() for HTML, json_encode() for JavaScript, and rawurlencode() for URLs. 3. Set HTTP headers like Content-Security-Policy, X-Content-Type-Options, and X-XSS-Protection to add defense layers. Consistently applying these practices blocks XSS vulnerabilities effectively.

To prevent cross-site scripting (XSS) attacks in PHP, you need to properly sanitize and escape any user-generated or untrusted data before displaying it in a browser. XSS attacks happen when an attacker injects malicious scripts into content that others view — often through forms, URLs, or cookies. The key is to always assume that input is unsafe until proven otherwise.

Sanitize Input When Accepting User Data

When users submit data to your application, whether through forms, query strings, or APIs, treat all input as potentially dangerous. Always filter and sanitize this data before storing or using it.

• Use PHP's built-in filtering functions like filter_var() with appropriate flags.
  • For emails: filter_var($email, FILTER_VALIDATE_EMAIL)
  • For URLs: filter_var($url, FILTER_VALIDATE_URL)
• If you're allowing some HTML input (like in a forum or CMS), use a whitelist-based HTML purifier like HTML Purifier instead of trying to strip tags manually.

Remember, validation isn't just about security — it also helps maintain clean data and improve user experience by catching errors early.

Escape Output Based on Context

Escaping output means converting special characters into safe representations depending on where the data will be used — HTML, JavaScript, CSS, or URLs. Different contexts require different escaping methods.

Here’s how to handle common cases:

• HTML Body: Use htmlspecialchars() with the correct encoding and quote style

  echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');

• HTML Attributes: Same function applies, but make sure quotes are escaped (ENT_QUOTES).
• JavaScript: Avoid injecting PHP variables directly into JS if possible. If needed, use json_encode() which handles escaping safely:

  var jsVar = <?php echo json_encode($user_input); ?>;

• URLs: Use rawurlencode() when building URLs dynamically from user input.

Always know what context you're outputting into — mixing up escaping types can leave vulnerabilities open.

Set Proper HTTP Headers to Mitigate Risks

HTTP headers can help protect against XSS even if some injection slips through. These headers add an extra layer of defense:

• Content-Security-Policy (CSP): Tells the browser which sources of scripts are allowed. This stops inline scripts from running unless explicitly permitted.

  header("Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;");

• X-Content-Type-Options: nosniff: Prevents browsers from MIME-sniffing responses, reducing risk of script execution from incorrectly served files.
• X-XSS-Protection: Enables the built-in XSS protection in older browsers (though CSP makes this less critical now).

These headers aren’t a replacement for proper sanitization and escaping, but they act as safety nets.

That’s basically how you cover the main areas to block XSS in PHP — sanitize input, escape output based on context, and use HTTP headers wisely. It doesn’t require fancy tools, just consistent practices.

The above is the detailed content of How do I prevent cross-site scripting (XSS) attacks in PHP?. For more information, please follow other related articles on the PHP Chinese website!