4

I have a form where users can fill in a news article. This contains a title and body. For each page to have a unique title, I'm using the user input (title) in the <title>-tags:

<title>$userinput</title>

I'm wondering - is it possible for the user to perform an XSS-attack this way? Should I escape this user input using htmlspecialchars?

The same also applies to <meta>-tags. I'm using user input for the description:

<meta name="description" content="$userinput" />

Can a user perform XSS-attacks in <title> and <meta>-tags?

Bv202
  • 3,924
  • 13
  • 46
  • 80
  • 1
    As soon as you write unescaped HTML to a webpage, there is a possibility of XSS. – zneak Jul 31 '11 at 17:51
  • possible duplicate of [Should I htmlspecialchar() variables inside ?](http://stackoverflow.com/questions/638057/should-i-htmlspecialchar-variables-inside-title-title) – mercator Jul 31 '11 at 17:56

3 Answers3

6

Should I escape this user input using htmlspecialchars?

Yes. Location doesn't matter. All user input should be escaped.

References:

Community
  • 1
  • 1
Mike B
  • 31,886
  • 13
  • 87
  • 111
3

He could close any tag first:

</title><script> alert('here I am') </script>

Qwerty
  • 1,732
  • 1
  • 13
  • 18
0

It is possible to perform an XSS attack that way.

I'd use htmlentities to begin with. Also you might want to consider HTML Purifier. Lastly, you might want to consider PHPIDS. That would be a bit overkill for most situations though...

Chris Smith
  • 764
  • 1
  • 9
  • 22