Search code examples
xsshtmlspecialcharsstrip-tags

why not using strip_tags() to prevent xss attack instead of htmlspecialchars()?

If I need to display $_GET values in templates, why not using strip_tags() to prevent xss attack instead of htmlspecialchars()?

Solution

  • Because strip_tags doesn't fix every possible abuse case. True, it fixes the worst offenders, but there are other cases, e.g. when inserting values back into <input> tags yourself, where the quotes can be broken out of.

    Consider: <input type="text" value="my string" />

    If my string comes from some other data source that isn't XSS-protected, it could conceivable contain something like: "><script ....

    which can use the original closing > of the input tag - and strip_tags may or may not catch that case. I seem to remember it looks for < followed by > which wouldn't be found in the above string.