Description

Cross-Site Scripting (XSS) is a security vulnerability typically found in web applications that allows attackers to inject malicious scripts into content from otherwise trusted websites. These scripts can then execute in the context of another user’s session, potentially stealing information or performing actions on behalf of the user.
we will know more about this vulnerability but from a developer’s perspective

• Vulnerable code
• Attack Scenario
• Mitigation

  Types of XSS

  ---

• Stored XSS: The malicious script is permanently stored on the target server, such as in a database, comment field, or any other data storage.
• Reflected XSS: The script is reflected off a web server, such as in an error message, search result, or any other response that includes some part of the request.
• DOM-Based XSS: The vulnerability exists in the client-side code rather than the server-side code.

  Stored XSS in PHP

  ---

  we have a php app that allows users to post comments
  Vulnerable Code

<?php
$conn = new mysqli('localhost', 'username', 'password', 'database');

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $comment = $_POST['comment'];
    $sql = "INSERT INTO comments (comment) VALUES ('$comment')";
    $conn->query($sql);
}

$sql = "SELECT comment FROM comments";
$result = $conn->query($sql);
while ($row = $result->fetch_assoc()) {
    echo $row['comment'] . "<br>";
}

$conn->close();
?>

In this code, the comment is taken directly from the user input and inserted into the database without any sanitization or escaping. When displaying the comments, the script is executed if it contains JavaScript.
Attack Scenario

<script>alert('XSS');</script>

This comment would be stored in the database and executed whenever a user visits the page displaying the comments.
Mitigation
To mitigate xss, we need to sanitize and escape user input via functions like htmlspecialchars to escape HTML characters like this:

$comment = htmlspecialchars($_POST['comment'], ENT_QUOTES, 'UTF-8');

htmlspecialchars escape HTML characters
ENT_QUOTES replace quote " ->&quot

Reflected XSS in PHP

Vulnerable Code

<?php
if (isset($_GET['name'])) {
    echo "Hello, " . $_GET['name'] . "!";
}
?>

the name is taken directly from the user input and reflected without any sanitization
Attack Scenario
An attacker could trick a user into clicking a URL like this:

http://example.com/page.php?name=<script>alert('XSS');</script>

when the user clicks the link, the script will execute in the user’s browser
Mitigation
Again, htmlspecialchars should be used to sanitize the input:

<?php
if (isset($_GET['name'])) {
    echo "Hello, " . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8') . "!";
}
?>

By escaping special characters, we ensure that any input provided in the name parameter is treated as plain text rather than executable code

DOM-Based XSS

Vulnerable Code

<!DOCTYPE html>
<html>
<body>
    <input id="userInput" type="text" value="<?php echo $_GET['name']; ?>">
    <script>
        var userInput = document.getElementById('userInput').value;
        document.write("Hello, " + userInput);
    </script>
</body>
</html>

in this code,Unsanitized User Input in HTML then direct usage of this input in JavaScript
Attack Scenario
An attacker could trick a user into clicking a URL like this:

http://example.com/page.php?name=<script>alert('XSS');</script>

This would result in the script being executed on the client side.
Mitigation
To prevent DOM-based XSS, avoid using document.write and use safer methods to manipulate the DOM, like textContent or proper escaping functions.

<!DOCTYPE html>
<html>
<body>
    <input id="userInput" type="text" value="<?php echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8'); ?>">
    <script>
        var userInput = document.getElementById('userInput').value;
        var textNode = document.createTextNode("Hello, " + userInput);
        document.body.appendChild(textNode);
    </script>
</body>
</html>

In this secured version:

• The PHP code escapes the input before outputting it into the HTML.
• The JavaScript code uses createTextNode to safely insert the text into the document.
  In general,to prevent xss
• Always sanitize and escape user input.
• Use functions like htmlspecialchars to convert special characters to HTML entities.
• Avoid using dangerous functions like document.write in client-side scripts.

• Validate and sanitize inputs on both server-side and client-side