XSS keep script tag and avoid attack - why aren't reliable

Question

I have some articles around the web that talks about XSS attack prevention,but I haven't found any solution:

htmlspecialchars(mb_convert_encoding($value, "UTF-8", "UTF-8"),ENT_QUOTES,'UTF-8')

or

json_encode($value, JSON_HEX_QUOT|JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS);

or simply strip_tags.
At this moment I'pm using these methos everytime I need to retrieve and display some information, execpt for the mesages, because it breaks the format

What I need to do is to prevent XSS attack from this situation:

I have got an upload form that if there are any error it returns the name and alert it;

echo '<script>parent.noty({text: "File Name:'.json_encode($_FILES['filename']['name'][$i]).' Error Code:'.$_FILES['filename']['error'][$i].'",type:"error",timeout:9000});</script>';

User can write messages that can contain html tags, such as the script one, I need to keep it: I use ckeditor to write new messages and I when I retrieve the message I need the main format(
...) to remain and make the script part armless

At this moment when I return the file name I use json_encode, but I'm not sure
EDIT
From the comments I have got that there aren't many possibilities, so I would like to know why those methods aren't reliable
EDIT
This is how I retrieve the messages:

$query = "SELECT 
                    a.enc_id,
                    IF(b.department_name IS NOT NULL, b.department_name,'Unknown'),
                    IF(c.name IS NOT NULL, c.name,IF(a.ticket_status='2','Not Assigned','Unknown'),
                    a.title,
                    CASE a.priority WHEN '0' THEN 'Low' WHEN '1' THEN 'Medium' WHEN '2' THEN 'High' WHEN '3' THEN 'Urgent' WHEN '4' THEN 'Critical' ELSE priority  END,
                    a.created_time,
                    a.last_reply,
                    CASE a.ticket_status WHEN '0' THEN '<span class=\'label label-success\'>Closed</span>' WHEN '1' THEN '<span class=\'label label-important\'>Open</span>' WHEN '2' THEN '<span class=\'label label-warning\'>To Assign</span>' WHEN '3' THEN '<span class=\'label label-important\'>Reported</span>' ELSE 'Error' END 
                FROM ".$SupportTicketsTable." a
                LEFT JOIN ".$SupportDepaTable." b
                    ON  b.id=a.department_id
                LEFT JOIN ".$SupportUserTable." c
                    ON c.id=a.operator_id
                WHERE a.user_id=".$_SESSION['id']." 
                ORDER BY a.last_reply DESC 
                LIMIT 350";
        $STH = $DBH->prepare($query);
        $STH->execute();
        $list=array('response'=>'ret','tickets'=>array('user'=>array()));
        $STH->setFetchMode(PDO::FETCH_ASSOC);
        $a = $STH->fetch();
        if(!empty($a)){
            do{
                $list['tickets']['user'][]=array('id'=>$a['enc_id'],'dname'=>$a['dname'],'opname'=>$a['opname'],'title'=>htmlspecialchars(mb_convert_encoding($a['title'], "UTF-8", "UTF-8"),ENT_QUOTES,'UTF-8'),'priority'=>$a['prio'],'date'=>$a['created_time'],'reply'=>$a['last_reply'],'status'=>$a['stat']);
            }while ($a = $STH->fetch());
        }
...
echo json_encode($list);

And your question now is where the next security consultant to book is located or what? — hakre, Aug 29 '13 at 15:44
possible duplicate of [How to prevent XSS with HTML/PHP?](http://stackoverflow.com/questions/1996122/how-to-prevent-xss-with-html-php) — , Aug 29 '13 at 15:45
@Dheed: You don't ask an answerable programming question which - following the about section - is actually what this website is about. Instead you provide diverse, unspecific information and throw in some terms. e.g. we can not see any of those articles you name, we have no clue what this is about. Why you specifically want to convert UTF-7 to UTF-8 for example and if the resource you are relating to is authorative or not. Make it a concrete programming question and explain what the concrete issue is and I'm pretty sure your question can be answered. — hakre, Aug 29 '13 at 16:37
The methods you want to learn about are *undefined* in your question. This is always not reliable because it is too vague. — hakre, Aug 29 '13 at 16:38
@hakre I have added some information about the code I'm using and what I was talking about — Razorphyn, Aug 29 '13 at 16:50
Wow, that is pretty, pretty broad! Those isolated code-chunks can't tell any story either (and some even so little code already smell fishy). I guess you really want to learn it. Perhaps starting with character encoding is a good way into the materia: http://stackoverflow.com/questions/279170/utf-8-all-the-way-through — hakre, Aug 29 '13 at 16:53
@hakre that's way I'masking, currently I have specified the charset in every page (UTF-8), but I have read that IE (from 6 to I don't know) have got some problems: [link](http://stackoverflow.com/questions/1412239/why-call-mb-convert-encoding-to-sanitize-text) — Razorphyn, Aug 29 '13 at 17:00
@Dheed: With that you are basically looking for input validity, e.g. if the input is actually utf-8 encoded. There are better routines for that. Apart from that, you normally do not want to allow the whole Unicode repository, therefore this link does only show a very little fraction on the topic (not well thought one could say) with quite a questionable method. I also wonder if that what the user writes is authorative. I would normally not expect the mb_string library to be tested well. There were many issues with it in the past and again and again. Let's see if there is better reference. — hakre, Aug 29 '13 at 17:08

score 0 · Answer 1 · answered Aug 29 '13 at 16:53

In this particular case, the correct way to escape your content is like so:

echo '...{text: "File Name:"+'.json_encode($_FILES['filename']['name'][$i]).'+" Error code...'

The reason for this is that json_encode will take any input and make it safe to dump in a JavaScript context. A string will be surrounded by quotes and appropriately escaped to be valid. However, you must close out of existing quotes before concatenating in your value for it to work.

That said, I'm assuming that the function putting this text into your page will use something like document.createTextNode(arguments[0].text); to create a text node, NOT an HTML context.

XSS keep script tag and avoid attack - why aren't reliable

1 Answers1