How to protect an input field that may contain html tags from XSS attacks?

I

IvanIF2020-10-01 20:51:49

Information Security

IvanIF, 2020-10-01 20:51:49

I have a thematic portal where users can publish their material.
This material may contain HTML tags, so it cannot be output via the htmlspecialchars() function.
It would be possible to filter tags with strip_tags(), but that doesn't solve the problem.
How to filter the received data and remove attacks like this:

<body onload=alert('xss')>
<img src=javascript:alert('xss')>
<body background="javascript:alert('xss')" >
<meta http-equiv="refresh" content="0;url=javascript:alert('xss');">
<style type="text/javascript">alert('xss');</style>

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

V

Vladimir Dubrovin, 2020-10-02
@IvanIF

Use DOMPurify

D

Dimonchik, 2020-10-01
@dimonchik2013

well, at least he specified the functions of pehape, since you forgot for the tag, you
leave only allowed tags and check by parsing xml for the contents
of such tags, you will have exactly one - img