XSS attack to bypass htmlspecialchars() function in value attribute

Posted by Setzer on Stack Overflow See other posts from Stack Overflow or by Setzer
Published on 2010-05-24T02:35:57Z Indexed on 2010/05/24 2:40 UTC
Read the original article Hit count: 811

Filed under:

xss

|

web-security

|

htmlspecialchars

Let's say we have this form, and the possible part for a user to inject malicious code is this below

... <input type=text name=username value=<?php echo htmlspecialchars($_POST['username']); ?>> ...

We can't simply put a tag, or a javascript:alert(); call, because value will be interpreted as a string, and htmlspecialchars filters out the <,>,',", so We can't close off the value with quotations.

We can use String.fromCode(.....) to get around the quotes, but I still unable to get a simple alert box to pop up.

Any ideas?

© Stack Overflow or respective owner

Related posts about xss

XSS filtering function in PHP

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, Does anyone know of a good function out there for filtering generic input from forms? Zend_Filter_input seems to require prior knowledge of the contents of the input and I'm concerned that using something like HTML Purifier will have a big performance impact. What about something like : http://snipplr… >>> More
A way around XSS?

as seen on Stack Overflow - Search for 'Stack Overflow'
In my page I have an script reference to the autoHeight.js file below. I also have an iframe that I want to resize using this code. In firebug I get this error Error: Permission denied for <http://www.siena.edu> to get property HTMLDocument.body from <https://siteframework.siena.edu>… >>> More
Why isn't ValidateRequest="true" enough for XSS prevention?

as seen on Stack Overflow - Search for 'Stack Overflow'
In the notes for Step 1 in the "How To: Prevent Cross-Site Scripting in ASP.NET" it is stated that you should "not rely on ASP.NET request validation. Treat it as an extra precautionary measure in addition to your own input validation." Why isn't it enough? >>> More
Why Google Wave & iGoogle cannot be XSS injected by a widget

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, If you've used google wave or iGoogle you probabely seen that you can insert widgets that are made by third parties without approval. the Question is : How this widgets can't inject XSS or steal the cookies, Are the widgets loaded in an <iframe> ? if yes, then how they can't redirect… >>> More
How Google Wave cannot be XSS injected by a widget

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, If you've used google wave you probabely seen that you can insert widgets that are made by third parties without approval. the Question is : How this widgets can't inject XSS or steal the cookies, Are the widgets loaded in an <iframe> ? if yes, then how they can't redirect google wave… >>> More

Related posts about web-security

System.Web.Security.FormsAuthentication.Encrypt returns null

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to encrypt some userData to create my own custom IPrincipal and IIdentity objects using Forms authentication - I've serialized an object representing my logged in user to Json and created my FormsAuthentication ticket like so: string user_item = GetJsonOfLoggedinUser();/*get JSON representation… >>> More
Google Releases Web Security Scanner

as seen on Devx - Search for 'Devx'
"Skipfish" helps developers test their Web apps for vulnerabilities. >>> More
Google Releases Web Security Scanner

as seen on Internet.com - Search for 'Internet.com'
"Skipfish" helps developers test their Web apps for vulnerabilities. >>> More
Web Security Threats on the Rise, Report Finds

as seen on Dot net Slackers - Search for 'Dot net Slackers'
It may not be Tony Soprano on the Web, but a new security report finds that wise-guy hackers have become increasingly organized....Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight… >>> More
Web Security: Worst-Case Situation

as seen on Stack Overflow - Search for 'Stack Overflow'
I currently have built a system that checks user IP, browser, and a random-string cookie to determine if he is an admin. In the worst case, someone steals my cookie, uses the same browser I do, and masks his IP to appear as mine. Is there another layer of security I should add onto my script to make… >>> More