PHP_SELF and SCRIPT_NAME - XSS attacks edition

Question

PHP_SELF opens up a page to XSS attacks when code such as echo $_SERVER['PHP_SELF'] is included, but what about SCRIPT_NAME? Since it does not include path info, is this safe to use? I know you can use htmlentities and other similar functions to sanitize but I'd rather avoid the extra function call.

I'm quite sure that it would be safe to use but I'd like the reassurance of the SO community :)

instigator · Accepted Answer · 2011-08-05 01:07:29Z

2

As good practice, you should always protect against any variables from $_SERVER, $_GET, $_POST etc.

$str = filter_var($input, FILTER_SANITIZE_STRING);

A simple way to sanitize a string, or you can use htmlentities. I create a class that I use when returning any variables from $_SERVER, $_GET and $_POST.

edited Aug 5, 2011 at 1:07

answered Aug 5, 2011 at 0:53

instigator

1,6875 gold badges16 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP_SELF and SCRIPT_NAME - XSS attacks edition

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related