Prevention of cross-site scripting attacks

Today we will answer a common customer question that is gaining popularity every day. What is a cross-site scripting attack? And let's look at ways to prevent cross-site scripting attacks.

What is a cross-site scripting attack?

Cross-site scripting attack – this is the introduction of malicious code into a web page that will be secretly executed on the user's computer. The specificity of a cross-site scenario attack is that using the embedded code section, you can get access to the session or authorized user data. With subsequent access to manage the data of this user.

Examples of cross-site scripting attacks

Let's say we want to be able to comment on a blog or article without worrying that the JS or Html code in the comment will create problems. We cannot restrict the user's input, because with this form, he must freely express his thoughts about the article. But, we can remove the ability to insert sections with HTML + JS, because in fact, no one except attackers will need to insert sections of code into a comment. We could create a check for the presence of these sites and simply not allow them to be published. But think about how many conditions we would have to use. Wow!

Preventing cross-site scripting attacks

How to prevent a cross-site scripting attack? The standard PHP method comes to the rescue. With the help of the htmlentities() function, we will be able to screen the parts of the malicious insertion. More details about this function can be found in the PHP documentation. There are a couple of functions in PHP's standard methods that can be used to escape HTML. The simplest is htmlspecialchars() – escapes four characters (< > “ and &) . But it is the htmlentities() function that converts any characters that have an HTML entity equivalent. There is one caveat, when converting this function, it uses the UTF-8 character set, so instead of inserting malicious code, we will get a section of ordinary characters. This way we can limit the introduction of malicious code into our blog comments. But do not forget that this is just one of the possible cross-site attacks of the "code injection" type. There is also a DDOS attack.