how to prevent XSS in javascript string

Question

Let's say I have something like this:

<script>
var string = '<?= $_GET['var'] ?>';
</script>

To prevent XSS I'd want to make sure the single quotes are escaped. addslashes could do that but people could still break out of that by setting $_GET['var'] to . eg.

<script>
var string = '</script><script>alert(/test/)</script>';
</script>

Maybe I should escape (with \) single quotes and <? Is that all I'd need to escape?

I suppose attacks like this are harder now that browsers often disable code from being ran that shows up in the GET string but idk I still think it's something that ought to be protected against .

Thumb rule: json_encode() for JavaScript, htmlspecialchars() for HTML — Álvaro González
– Álvaro González, Commented Feb 23, 2017 at 17:07
Possible duplicate of stackoverflow.com/questions/3043775/how-to-escape-html — Ludo237
– Ludo237, Commented Feb 23, 2017 at 17:08

Thomas · Accepted Answer · 2017-02-23 17:10:42Z

1

by

<script>
var string = <?= json_encode($_GET['var']) ?>;
</script>

without the surrounding quotes.

answered Feb 23, 2017 at 17:10

Thomas

12.8k1 gold badge16 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

neubert Over a year ago

htmlspecialchars would still be needed for the < and > but I'm thinking that's the best answer. Well that and the fact that the surrounding string delimiters (single quote in this case) shouldn't be present since json_encode adds them.

Thomas Over a year ago

@neubert, about htmlspecialchars for the html-tags. Just did a quick test on phpfiddle, and it seems that json_encode() takes care of that. Although it only escapes the backslash in the injected </script> tag, checking the DOM, the Browser seems fine with that. So I'd be more worried that htmlspecialchars may change the string and therefore its meaning.

Vasiliy Zverev Over a year ago

json_encode($_GET['var'], JSON_HEX_QUOT | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS) Submitted edit to the answer.

Vasiliy Zverev Over a year ago

without JSON_HEX_* the following attack is possible:

<?php $_GET['var'] = " '><a href=/test>click me<!--"; ?> <div onmouseover='x = <?php echo json_encode($_GET['var']) ?>'></div>

Sumit Over a year ago

@VasiliyZverev onmouseover's value is JavaScript inside HTML, so for that you probably want to use htmlspecialchars(json_encode($_GET['var']), ENT_QUOTES, 'UTF-8') instead.

|

Vasiliy Zverev · Accepted Answer · 2017-08-31 22:48:13Z

1

<script>
var string = <?= json_encode($_GET['var'], JSON_HEX_QUOT | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS) ?>;
</script>

Please note that no surrounding quotes needed. json_encode() produces quoted string "bla-bla-bla". Parameters JSON_HEX_QUOT | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS convert ", <, >, &, ' to hex like \u003C. This helps against XSS when JS is inline:

<?php
    $_GET['var'] = " '><a href=/test>click me<!--";
?>
<div onmouseover='x = <?= json_encode($_GET['var'], JSON_HEX_QUOT | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS) ?>'></div>

answered Aug 31, 2017 at 22:48

Vasiliy Zverev

6605 silver badges11 bronze badges

Collectives™ on Stack Overflow

how to prevent XSS in javascript string

2 Answers 2

6 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

6 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related