Search code examples
phpxssveracode

How to fix “Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)” in PHP output string

I have the following php code

<?php 
$Output = '<table><thead><tr>';
$Output .= '<th>Display</th></tr></thead><tbody>'; 
for ($k = 0; $k < count($ColumnsInSQL); $k++) { 
    $Output .= '<tr><td>'.$KS_ResultSet_level[$k][strtoupper(trim($ColumnsInSQL[$k]))].'</td></tr>';
}
$Output .= '</tbody></table>';
echo $Output;
?>

Recently I run the code in Veracode and I am getting issue with "echo $Output;".

Can anyone please help me to fix this?

Solution

  • Use htmlentities() to encode special characters in the variable data.

    $Output .= '<tr><td>'.htmlentities($KS_ResultSet_level[$k][strtoupper(trim($ColumnsInSQL[$k]))]).'</td></tr>';