PHP XSS validation not working

Question

I have written a simple contact form script and am trying to add XSS validation to it using the method described on W3School. Unfortunately it doesn't work as if I enter a "<" in one of the fields and then submit, it comes out as "<" when I receive it via email.

Can anyone suggest what I'm doing wrong?

Data collection section

$name = $co = $email = $tel = $message = "";

if ($_SERVER["REQUEST_METHOD"] == "POST"){
$name = test_input($_REQUEST['name']);
$co = test_input($_REQUEST['company']);
$email = test_input($_REQUEST['email']);
$tel = test_input($_REQUEST['tel']);
$message = test_input($_REQUEST['message']);
}

Data testing function

function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}

Many Thanks

This one is a good solution with php function: stackoverflow.com/a/70807494/10666501 — Ali Haider
– Ali Haider, Commented Jan 21, 2022 at 21:20

dev0 · Accepted Answer · 2015-10-13 19:21:59Z

0

Maybe your email client is configured to show the email as HTML. htmlspecialchars will convert < to < Try to display your email as plain text.

answered Oct 13, 2015 at 19:21

dev0

1,0578 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Tessa Over a year ago

Thanks for the suggestion. I set Outlook to read messages as plain text but the "<" symbol was still showing.

dev0 Over a year ago

I don't see any problems in the code you provided. Maybe some reconverting happens before sending the email? You might be better off using $_POST instead of $_REQUEST.

Tessa Over a year ago

Thanks, I tried both $_POST and $_REQUEST and it had the same outcome however I think you're right. I think what's happening (from the message I'm getting from Outlook) is that it's retrieving the message as HTML and then converting it to plain text which I imagine causes the "<" to be converted anyway.

Collectives™ on Stack Overflow

PHP XSS validation not working

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related