Can't use htmlspecialchars in foreach loop with array, why?

Question

I've working on some security stuff, and php is giving me some odd behaviour. Could you help me figure out what's going on? :)

So, I have an array of inputs, like so

$first_name = "<script>alert();</script>";
$middle_name = 'Robert';
$last_name = 'Smith';
$username = 'testusername1';
$email = "testemail@mail.com";
$password = 'banana1';

and I am testing them for XSS, using htmlspecialchars, like this.

$first_name = htmlspecialchars($first_name, ENT_QUOTES, 'UTF-8');

Which works just fine to stop the script in the $first_name running.

However, paste this code into a foreach loop, and the javascript alert runs.

Here is my current foreach loop (not working properly)

$strings = 
array($first_name,$middle_name,$last_name,$username,$email,$password);

foreach($strings as $string) {
    $string = htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
}

I'm not sure what I'm missing here. I guess it's something to do with assigning the converted string back into the array? But that sounds so confusing it just doesn't feel like the right answer. Idk.

Thank you for your help.

Andrew

Answer 1

Looks like you're trying to make a foreach loop by reference, You need a & to make your foreach data changes persist outside of that loop...

foreach($strings as $string) {

Should be:

foreach($strings as &$string) {

As kindly pointed out by @CBroe we must use unset to free the variable used in the foreach loop... Therefore your full solution will become:

$strings = 
array($first_name,$middle_name,$last_name,$username,$email,$password);

foreach($strings as &$string) {
    $string = htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
}     

unset($string);

Answer 2

You cannot reassign an array element like that. You need to do it with the element's index.

foreach($strings as $index=>$string) {
    $strings[$index] = htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
}

Answer 3

You could use the following method without using references:

foreach($strings as $key => $string) {
    $strings[$key] = htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
}

Answer 4

there is a problem in foreach, maybe the htmlspecialchars function will be run correctly. please check following article.

https://stackoverflow.com/questions/10057671/how-does-php-foreach-actually-work

Answer 5

foreach works on a copy of the the array, no changes will persist.

// your array
$strings = array(
    'first_name'    => $firstname,
    'middle_name'   => $middle_name,
    'last_name'     => $last_name,
    'user_name'     => $username,
    'email'         => $email,
    'password'      => $password
);

// filtered: the array which contains your escaped data.
$filtered = array_map(function($string) { 
                  return htmlspecialchars($string, ENT_QUOTES, 'UTF-8'); 
            }, $strings);

// to access your filtered data:
// $filtered['first_name'] contains the filtered first name
// $filtered['middle_name'] contains the filtered middle name
// and so on ...

Answer 6

A bit late to the party; however, I guess the simplest way is to use array_map, and then there would be no need to go for a foreach loop.

array_map('htmlspecialchars', $strings);

Consequently, the whole code would look like the following:

        $first_name = "<script>alert();</script>";
        $middle_name = 'Robert';
        $last_name = 'Smith';
        $username = 'testusername1';
        $email = "testemail@mail.com";
        $password = 'banana1';
         // Here goes your string which is an array of the above variables...
        $strings = array ($first_name, $middle_name, $last_name, $username, $email, $password);
         // Here goes the trick :) 
        $strings = array_map('htmlspecialchars', $strings);