" . htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8') . "
";
```
#### HTML Attribute Context
```php
// INCORRECT
echo "";
```
#### URL Context
```php
function escapeUrl($url) {
// Use urlencode for URL parameters
return urlencode($url);
}
// Better: validate and then escape
function safeUrl($url) {
$validated = filter_var($url, FILTER_VALIDATE_URL);
return $validated ? htmlspecialchars($validated, ENT_QUOTES, 'UTF-8') : '';
}
```
## Content Security Policy (CSP)
CSP is a security standard that helps prevent XSS by controlling which resources can be loaded and executed.
### Basic CSP Header
```php
// PHP header
header("Content-Security-Policy: default-src 'self'");
// HTML meta tag
```
### Comprehensive CSP
```php
header("Content-Security-Policy: "
. "default-src 'self'; "
. "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
. "style-src 'self' 'unsafe-inline'; "
. "img-src 'self' data: https:; "
. "font-src 'self' data:; "
. "connect-src 'self'; "
. "media-src 'none'; "
. "object-src 'none'; "
. "child-src 'self'; "
. "frame-ancestors 'none'; "
. "form-action 'self'; "
. "upgrade-insecure-requests"
);
```
### CSP Nonces for Inline Scripts
```php
// Generate nonce
$nonce = bin2hex(random_bytes(16));
// Set CSP header
header("Content-Security-Policy: script-src 'self' 'nonce-{$nonce}'");
// Use nonce in script
echo "";
```
## Input Validation and Sanitization
### Input Validation (Defense in Depth)
```php
// Validate input format before output
function validateAndDisplayName($name) {
// Validate format (allow-list approach)
if (!preg_match('/^[a-zA-Z\s\-\.\']{1,100}$/', $name)) {
return 'Invalid name format';
}
// Even with validation, still escape output
return htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
}
```
### Input Sanitization
```php
function sanitizeHtml($input) {
// Remove potentially dangerous tags
$allowedTags = '
';
return strip_tags($input, $allowedTags);
}
function sanitizeForDisplay($input) {
// Multi-step sanitization
$input = trim($input); // Remove whitespace
$input = htmlspecialchars($input, ENT_QUOTES); // Escape HTML
$input = filter_var($input, FILTER_SANITIZE_STRING); // Additional sanitization
return $input;
}
```
## Laravel XSS Protection
### Blade Templating Engine
Laravel's Blade engine automatically escapes output:
```blade
{{-- Automatic escaping --}}
Welcome, {{ $name }}
{{-- Explicit unescaping (use only for trusted content) --}}
Welcome, {!! $trustedHtml !!}
```
### Blade Escaping Functions
```blade
{{-- HTML escaping --}}
{{ $userInput }} {{-- Automatically escaped --}}
{{-- JavaScript escaping --}}
{{-- Attribute escaping --}}
{{-- Raw output (dangerous - only for trusted content) --}}
{!! $htmlContent !!}
```
### Laravel Form Helpers
```php
// Form input with automatic escaping
Form::text('name', $value);
// Raw form input (requires manual escaping)
Form::macro('rawText', function($name, $value) {
return '';
});
```
### Laravel Security Middleware
```php
headers->set('X-XSS-Protection', '1; mode=block');
$response->headers->set('X-Content-Type-Options', 'nosniff');
// Add CSP header
$response->headers->set('Content-Security-Policy',
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'");
return $response;
}
}
```
## Advanced XSS Prevention Techniques
### 1. Template Engines
Using dedicated template engines prevents XSS:
```php
// Twig (PHP template engine)
$loader = new Twig_Loader_Filesystem('templates/');
$twig = new Twig_Environment($loader, [
'autoescape' => 'html' // Automatic escaping
]);
echo $twig->render('page.html', ['name' => $userInput]);
```
### 2. HTML Purifier
Comprehensive HTML sanitization library:
```php
require_once 'vendor/ezyang/htmlpurifier/library/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
// Clean HTML input
$cleanHtml = $purifier->purify($userInput);
echo $cleanHtml; // Safe to display
```
### 3. Input Encoding Validation
Ensure input encoding is valid:
```php
function validateAndNormalizeInput($input) {
// Check for valid UTF-8
if (!mb_check_encoding($input, 'UTF-8')) {
throw new Exception('Invalid character encoding');
}
// Normalize Unicode (prevent homograph attacks)
$input = normalizer_normalize($input, Normalizer::FORM_C);
// Remove control characters
$input = preg_replace('/\p{Cc}/u', '', $input);
return $input;
}
```
## XSS in Different Contexts
### 1. JSON Responses
```php
// VULNERABLE: Direct JSON output
header('Content-Type: application/json');
echo json_encode(['message' => $_GET['msg']]);
// SECURE: Validate input before JSON encoding
$message = htmlspecialchars($_GET['msg'], ENT_QUOTES);
echo json_encode(['message' => $message]);
```
### 2. XML Output
```php
// VULNERABLE: Direct XML output
$message = $_POST['message'];
$xml = "{$message}";
// SECURE: Escape XML entities
$message = htmlspecialchars($message, ENT_QUOTES);
$xml = "{$message}";
```
### 3. CSS Injection
```php
// VULNERABLE: Direct CSS output
$color = $_GET['color'];
echo "";
// SECURE: Validate CSS values
$allowedColors = ['red', 'blue', 'green', 'black', 'white'];
$color = in_array($color, $allowedColors) ? $color : 'white';
echo "";
```
## XSS Testing and Detection
### Manual Testing
```html
