Crosssite Scripting issues

Question

Right now im trying to filter all of my variables to secure my site from xss. I read a few things here and there and to me it seems the best way to do that would be to whitelist all charackters that i need for numbers i use

$adrnr = preg_replace("/[^0-9]/", "", $adrnr);

but if it comes to words Im haveing a issue since im german I would need to whitelist ü,ä,ö and ß is there a way to do so?

Answer 1

While you can (or even should) filter/convert/validate your input, XSS prevention has to be done for your output, because what you have to do is context-based. htmlspecialchars() saves you in a lot of locations in your output, but not in all. See the OWASP XSS Prevention Cheat Sheet.

For your input validation of german names you may simply use this:

preg_match('/^[a-zA-ZäöüßÄÖÜ ]+$/', $nachname)

Answer 2

You simply need to use htmlspecialchars to escape HTML chars.