0

I got this little website where i tryed out some xss attacks. They were succesfull. I just needed to add

?query=<script>alert("Alarm")</script>

behind my URL. I Also can attack my Website with an Image Tag or other Alternatives.

Now im trying to protect me against these attacks. But i cant make it. Of Course the Problem lays in Line 11. As you can see i already tryed to use htmlspecialchars

Below is the Website Code:

<html>
<head><title>Search and Destroy</title>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" >
</head>
<body>
<h1>Search and Destroy</h1>
<h2>Wer suchet, der findet.</h2>

<p>Geben Sie ein Kästchen ein (von A0 bis J9), auf das Sie schießen möchten!</p>
</p>

<form action="?" method="get">
  <input type="text" name="query" maxlength="2" size="2" value="<?php echo $_REQUEST[htmlspecialchars('query')];?>">
  <input type="submit">
</form>


<?php

if($_REQUEST['query']) {
        $arr = array();
        $arr['A'] = 'UU K  ZZZZ';
        $arr['B'] = '   K      ';
        $arr['C'] = 'Z  K KKK U';
        $arr['D'] = 'Z        U';
        $arr['E'] = 'Z         ';
        $arr['F'] = 'Z    U   K';
        $arr['G'] = '     U   K';
        $arr['H'] = 'UU       K';
        $arr['I'] = '          ';
        $arr['J'] = '     SSSSS';

        $req = $_REQUEST['query'];

        echo "<p>Trage Torpedo-Koordinaten ein: <b>($req)</b>...";
        $row = strtoupper($req[0]);
        $col = $req[1];


        if(strlen($req)>2) {
                echo "<p>Die Torpedo-Koordinaten sind ungültig!</p>";
        } else {
                echo "<p>Feuer frei!</p>";
                $feld = $arr[$row][$col];
                if($feld==' ') {
                        echo "<p>Daneben! Sie haben leider nichts getroffen</p>";
                }
                elseif($feld=='U') {
                        echo "<p>Sie haben <b>ein U-Boot</b> getroffen</p>";
                }
                elseif($feld=='K') {
                        echo "<p>Sie haben <b>einen Kreuzer</b> getroffen</p>";
                }
                elseif($feld=='Z') {
                        echo "<p>Sie haben <b>einen Zerstörer</b> getroffen</p>";
                }
                elseif($feld=='S') {
                        echo "<p>Sie haben <b>das Schlachtschiff</b> getroffen</p>";
                }
                else {
                        echo "<p>Nehmen Sie erst einmal einen Schluck Zielwasser! Sie haben ja total am Spielfeld vorbei geschossen!</p>";
                }
        }
}
?>

</body>
</html>
MrRementer
  • 21
  • 3
  • 1
    Typo. You need to run `htmlspecialchars` over the value you get **from** `$_REQUEST` not over the key you pass into it. – Quentin May 14 '21 at 13:33
  • 1
    [Avoid $_REQUEST though](https://stackoverflow.com/a/2142754/19068) – Quentin May 14 '21 at 13:34
  • 1
    And you eed to escape it *everywhere* you put user input to the HTML document, not just the text input. – Quentin May 14 '21 at 13:35
  • Could i just use ```$req = htmlspecialchars($req);``` once? – MrRementer May 14 '21 at 13:41
  • 1
    Only pass things through `htmlspecialchars` when you insert them into HTML. Don't do further processing on something after escaping it for HTML. `if(strlen($req)>2) {` will give different results for `<` and `htmlspecialchars('<')`. – Quentin May 14 '21 at 13:43

0 Answers0