Sanitizing GET Request and result of scan

Question

I am trying to sanitize my GET variables but Accuntrix is still complaining for some reason.

So I visit a page and the URL contains parameters. I pass these parameters between pages. To do this I do something like the following

<a class="navbar-brand" href="https://someDomain/someFolder/someFile.php?WT.var1=<?php echo $_GET['WT_var1']; ?>&var2=<?php echo $_GET['var2']; ?>&var3=<?php echo $_GET['var3']; ?>&var4=<?php echo $_GET['var4']; ?>" title="logo"><img src="logo.png"></a>

I have lots of links like this on the page, and when I first ran the page it was vunerable to cross site scripting because I was not sanitizing the GET requests. So at the top of the page, I put

<?php
    $_GET['WT_var1'] = htmlspecialchars($_GET['WT_var1']);
    $_GET['var2'] = htmlspecialchars($_GET['var2']);
    $_GET['var3'] = htmlspecialchars($_GET['var3']);
    $_GET['var4'] = htmlspecialchars($_GET['var4']);
?>

Initially, this seemed to work. But I have recently run another scan, and every single link like the above shows up as a high. The details look something like this

URL encoded GET input WT.var1 was set to 1}body{acu:Expre/**/SSion(prompt(926954))}
The input is reflected inside a text element.

And the exploit looks like this

/someFolder/someFile.php?WT.var1=1%7dbody%7bacu:Expre/**/SSion(prompt(941830))%7d&var2=&var3=&var4=

Is that not showing a sanitized url though? Is this something I need to fix or is it a false/negative?

Thanks

Answer 1

htmlspecialchars() encodes your variable for output as content in an html page. If you need to pass your variables through the url, you need urlencode(().

So for example:

...someFolder/someFile.php?WT.var1=<?php echo urlencode($_GET['WT_var1']); ?>&var2...