How to output HTML but prevent XSS attacks

Question

I wrote a php script to fetch the email content.

These contents are HTML format.

I'd like to display the content, as below

<?php 
$email_content = '
    <html>
        <script>alert("XSS");</script>
        <body>
            <div>Line1</div>
            <div>Line2</div>
        </body>
    </html>
';
echo $email_content;
?>

As you can see, it will cause XSS attacks. But if I use htmlspecialchars function, it will not show the correct HTML format, how should I do in this case? Thanks.

Use something like htmlpurifier.org or take a look here stackoverflow.com/questions/7130867/… — tlenss
– tlenss, Commented Jun 20, 2013 at 7:37
Here I can see an error <script>alert('XSS');</script> . It should be <script>alert(\'XSS\');</script> — Amar Banerjee
– Amar Banerjee, Commented Jun 20, 2013 at 7:38
you can use htmlspecialchars_decode($str, ENT_NOQUOTES); after using htmlspecialchars()... — Rajeev Ranjan
– Rajeev Ranjan, Commented Jun 20, 2013 at 7:58

MrCode · Accepted Answer · 2013-06-20 07:37:46Z

5

HTMLPurifer can do that:

require_once '/path/to/HTMLPurifier.auto.php';

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($dirty_html);

It takes dirty HTML (ie possibly containing Javascript) and removes any script.

PHP doesn't have anything native or built in that can remove Javacript like HTMLPurifier. You could use DOMDocument but this would be a lengthy task because Javascript can execute in some attributes (onerror, onclick) and is not just limited to <script></script>.

answered Jun 20, 2013 at 7:37

MrCode

64.6k10 gold badges95 silver badges114 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Cynial Over a year ago

I just tried it, not bad. But it removed unexpected content. The email content could be very complex but HTMLPurifer seems doesn't work stable on it.

MrCode Over a year ago

What did it remove? HMTLPurifer has lots of config options to change what it does/doesn't remove. The default config might not be exactly what you want.

Cynial Over a year ago

The signature line. There are no unsafe thing in it. The weird thing is some signature appear, some signature removed. It seems unstable. But maybe you're right, I need to dive into the config.

Cynial Over a year ago

I figured out. My email content has multiple <html> tags, HTMLPurifer just fetch <div> content from <html> tag (Ref function: tokenizeHTML), so we need to explode it, and use purifyArray function.

Community · Accepted Answer · 2023-11-17 20:13:27Z

1

You should use strip_tags() function and allow only tags that you want user to add.

echo strip_tags($text, '<p><a>');

This line allows <p> and <a> tags every other tag will be removed.

htmlspecialchars() works totally different.

From manual:

The translations performed are:

 '&' (ampersand) becomes '&amp;'
 '"' (double quote) becomes '&quot;' when ENT_NOQUOTES is not set.
 "'" (single quote) becomes '&#039;' (or &apos;) only when ENT_QUOTES is set.
 '<' (less than) becomes '&lt;'
 '>' (greater than) becomes '&gt;'

There is very nice article about XSS prevention and CSRF prenvetion read it.

edited Nov 17, 2023 at 20:13

CommunityBot

11 silver badge

answered Jun 20, 2013 at 7:43

Robert

20.3k6 gold badges58 silver badges85 bronze badges

4 Comments

Cynial Over a year ago

If I need img tag, but they use image XSS attacks?

MrCode Over a year ago

strip_tags() is not good enough because XSS can be present in attributes, it's not limited to <script></script>. Also in some circumstances strip_tags() can be bypassed.

Robert Over a year ago

@Cynial it's not XSS attack it's CSRF then. Read more about CSRF here stackoverflow.com/questions/1780687/preventing-csrf-in-php

samuirai Over a year ago

@Robert that is wrong. an <img> tag can also trigger XSS. Example: <img src="not_existent.png" onerror="alert('XSS')">... Never output untrusted HTML. It's a battle you can hardly win. There are an endless amount of attack vectors.

Collectives™ on Stack Overflow

How to output HTML but prevent XSS attacks

2 Answers 2

4 Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related