How to block javascript:// as url parameter

Question

I'm currently writing a PHP script for a guestbook in PHP where people can put their name, website and messages in a form, but I want to prevent someone from putting javascript:// in de url box to reduce the risk of XSS, I've tried to solve this with:

<?php filter_var($_POST['website'], FILTER_VALIDATE_URL) ?>

But I'm still able of putting javascript:// in de url box how could I prevent this?

Because that is a valid url. You'd have to parse the url and check what protocol is being used. — Marc B
– Marc B, Commented Mar 20, 2012 at 18:37

sbstjn · Accepted Answer · 2012-03-20 18:45:10Z

3

A clean solution would be using PHP's parse_url function and to check if the used protocol is HTTP or in a list of allowed protocols if you're allowing http:// and skype:// for example…

$url = 'http://username:password@hostname/path?arg=value#anchor';
$tmp = parse_url($url);

if ($tmp['scheme'] === 'http') {
  echo 'is http://';
}

if (in_array($tmp['scheme'], array('http', 'skype', 'call')) {
  echo 'is allowed protocol';
}

answered Mar 20, 2012 at 18:45

sbstjn

2,2241 gold badge16 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

TRiG · Accepted Answer · 2012-03-20 18:44:27Z

2

$chk = parse_url($url);

switch ($chk['scheme']) {
case 'http':
case 'https':
    break;
default:
    // throw error here
    break;
}

answered Mar 20, 2012 at 18:44

TRiG

10.7k9 gold badges62 silver badges113 bronze badges

Comments

David Houde · Accepted Answer · 2012-03-20 18:44:15Z

-1

with preg_replace

$website = preg_replace("/(javascript:\/\/)/i", "http://", mysql_real_escape_string($_POST['website']));

or with str_ireplace

$website = str_ireplace("javascript:", "http:", mysql_real_escape_string($_POST['website']));

edited Mar 20, 2012 at 18:44

answered Mar 20, 2012 at 18:38

David Houde

4,7881 gold badge22 silver badges29 bronze badges

1 Comment

Erlend Over a year ago

If $Website is put into a <a href=""></a> your replacing is circumvented if you html encode any of the letters in javascript. javascript:alert(1)

Collectives™ on Stack Overflow

How to block javascript:// as url parameter

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related