Xss when echoing direct from url

Question

I am printing directly form the url like

if(isset($_GET['name']){
   echo $_GET['name'])
}

but my friend told me that its bad and vulnerable to XSS now how is it bad and what should i do to prevent XSS?

score 1 · Accepted Answer · answered Jul 11 '13 at 04:20

1

just wrap content that should not contain tags in htmlspecialchars

echo htmlspecialchars($_GET["name"]);

answered Jul 11 '13 at 04:20

Orangepill

so you mean i should use this function everywhere when i want to echo content ..taken by user ? – IE kills stay away from it Jul 11 '13 at 04:39
Definitely a good start, but note that `htmlspecialchars` alone is not a silver bullet against XSS, especially when putting user input into HTML attributes, for example. It's all about context; what you specifically do with the user input. – Wesley Murch Jul 11 '13 at 04:47

1 Answers1