PHP Developers Network

I am beginner and I am struggling with kind of attack called (XSS). I tried this codes on my [url]127.0.0.1/myweb/home.php?u=paul[/url] and then this is the result: [url]127.0.0.1/myweb/home.php/"><script>alert('hacked')</script>/>"><script>alert("XSS")</script>&?u=daniel[/url]. And now it appears that my web page is been hacked, I do not have any security or validation code to prevent this so I am looking for sample codes, or advices to apply on my application thank you.

Start with this: http://php.net/manual/en/function.htmlspecialchars.php

_________________
Supported PHP versions No longer supported versions

I recommend using a secure password for your site, ftp credentials or WP as the case may be. This will keep miscreants out.

_________________
Hardcore Games Legendary is the Only Way to Play!
Vegan Advocate 16 lbs grain to make only 1 lb meat, water for 6 months of showers and 34.1 lbs carbon dioxide
My sites are made with WordPress, which is a content management system which now accounts for more than 60% of all websites

No, no it won't. If your site is vulnerable to cross site scripting, having a "secure password" won't do anything to prevent that. Ditto SQL injection and other common vulnerabilities. Secure passwords are great, but they're not a panacea.

_________________
Supported PHP versions No longer supported versions

Yes, this is exactly right. CSS and SQL injection can happen on public search forms, login pages, etc. that are irrelevant to password security. And yes, strong password are still a good thing.

_________________
(#10850)