PHP Security and XSS attacks - Getting Error Refused to execute a JavaScript script. Source code of script found within request

Question

I'm going through my site and doing a security audit. I've simply accepted the fact that I need to sanitize ALL user input, but I've never really stopped and experimented with what's really going on. I'm starting to experiment now.

I have a typical contact form on a PHP page. It's _POSTing data. $_POST["first_name"]; etc.

I do this $firstName = htmlspecialchars($_POST["first_name"]); to sanitize and display a message like the one below.

echo $firstName . ', thank you for your interest. We'll be in touch soon!'

I started to play with this and if I enter something such as <script>alert('hello')</script> in the first name field, htmlspecialchars does it's job and coverts the tags.

When I remove htmlspecialchars the script doesn't get converted and it displays in the source as <script>alert('hello')</script> BUT, it does not execute.

My question is, why doesn't this execute? Isn't this basically what an XSS attack would do? Am I misunderstanding something?

@symcbean - I just checked. Yes, there is an error. "Refused to execute a JavaScript script. Source code of script found within request." — Paul Dessert
– Paul Dessert, Commented Aug 1, 2012 at 22:52
use htmlspecialchars($_POST["first_name"], ENT_QUOTES); instead — zerkms
– zerkms, Commented Aug 1, 2012 at 22:53

Nikola K. · Accepted Answer · 2012-08-01 23:25:08Z

5

When I tried this in Chrome I saw an error in the console:

Refused to execute a JavaScript script. Source code of script found within request.

So it's possible modern browsers do this check to prevent it. You should continue to sanitize your input regardless of course, but check your console and you will probably see this.

edited Aug 1, 2012 at 23:25

Nikola K.

7,15313 gold badges33 silver badges39 bronze badges

answered Aug 1, 2012 at 22:49

Explosion Pills

192k56 gold badges341 silver badges417 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Paul Dessert Over a year ago

I just checked and saw the same error. So, in theory, this is how an XSS attack would take place, correct?

Explosion Pills Over a year ago

@Paul try it in Internet Explorer (an older version) which may not have such a sophisticated check. Other than that, read up on how XSS attacks are made. They can be made in so many ways .. the only limit is your imagination.

user2428118 Over a year ago

Since Chrome 11, it includes an XSS filter. Many other browsers don't, and XSS filters can't catch anything (persistent XSS in particular).

Collectives™ on Stack Overflow

PHP Security and XSS attacks - Getting Error Refused to execute a JavaScript script. Source code of script found within request

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related