XSS : Creating a javascript object using PHP's json_encode

Question

Is this 100% safe against XSS? If not, can you please provide example bad string text showing me why it is not.

<html>
  <body>
    <script>
      <?php
        $bad = "some bad string.  please give example text that makes the below unsafe";
        echo "var a = ".json_encode($bad).";";
        echo "var b = ".json_encode(array($bad)).";";
      ?>
    </script>
  </body>
</html>

Thanks.

That kinda depends on what you eventually do with a doesn't it? — chustar
– chustar, Commented May 6, 2011 at 15:24
Where is $bad actually coming from? Not that it matters since json_encode only creates valid JSON, which is "non-executable". — Kevin Peno
– Kevin Peno, Commented May 6, 2011 at 15:25
I'm mainly concerned about $bad containing javascript that is somehow executed. Based on Lekensteyn's answer below, it seems that this is impossible and so it is safe. But if anyone can show me otherwise it would certainly be a shock to my system! — user324289
– user324289, Commented May 6, 2011 at 15:34

Lekensteyn · Accepted Answer · 2011-05-06 15:32:05Z

5

In short, it's safe. Possible XSS would require escaping from the javascript string (") or script (</script>). Both strings are properly escaped:

"          becomes  \"
</script>  becomes  <\/script>

This is the the part about direct injection. Your application should take in account that some array elements may be missing. Another possibility is that an array element is not the type you would expect (e.g., an array instead of a string)

edited May 6, 2011 at 15:32

answered May 6, 2011 at 15:26

Lekensteyn

67k25 gold badges169 silver badges205 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

gouchaoer · Accepted Answer · 2016-10-25 02:57:09Z

1

Definitely not!!!

Don't use json_encode to escape javascript.

for example:

json_encode<img src=# onerror=alert(1)>, this will escape nothing and output to brower. This is a xss.

use htmlspecialchars instead.

answered Oct 25, 2016 at 2:57

gouchaoer

6452 gold badges8 silver badges22 bronze badges

2 Comments

JoeMoe1984 Over a year ago

This is the correct answer. In short most things aren't safe and this proves it.

Sergei Morozov Over a year ago

Isn't it still safe to use in Javascript context which the original question is about, not in HTML context? Of course, htmlspecialchars() is correct in HTML context.

Collectives™ on Stack Overflow

XSS : Creating a javascript object using PHP's json_encode

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related