Is using htmlspecialchars() sufficient in all situations?

Question

My users are allowed to insert anything into my database.

So using a whitelist / blacklist of characters is not an option.

I'm not worried (covered it) about the database end (SQL injection), but rather code injection in my pages.

Are there any situations where htmlspecialchars() wouldn't be sufficient to prevent code injection?

So, are they allowed to enter anything or disallowed to enter at least angle brackets? — Your Common Sense, Nov 12 '11 at 18:34
@downvoter: why the downvote? dupe somewhere? tell me please. — PeeHaa, Nov 12 '11 at 18:38
if anything is allowed, you don't have to replace angle brackets. Make your mind at last. — Your Common Sense, Nov 13 '11 at 02:42
@Col.Shrapnel: Now why would you say that??? Anything is allowed as input doesn't mean anything should get 'executed' when displayed... E.g. when a user signs up he can use `` as a username, but I don't want that javascript to get executed when another user visits his profile. — PeeHaa, Nov 13 '11 at 04:04
so, javascript is not allowed. You are contradict with yourself :) — Your Common Sense, Nov 13 '11 at 04:22
@Col.Shrapnel: since you fail to read: Col. you're right! :) — PeeHaa, Nov 13 '11 at 13:48

score 4 · Accepted Answer · edited Feb 22 '13 at 12:19

4

Plain htmlspecialchars is not sufficient when inserting user text into single quoted attributes. You need to add ENT_QUOTES in that case and you need to pass the encoding.

<tag attr='<?php echo htmlspecialchars($usertext);?>'> //dangerous if ENT_QUOTES is not used

When inserting user text into javascript/json as string you'll need additional escaping.

I think it fails for stange character sets too. But if you use one of the usual charsets UTF-8, Latin1,... it will work as expected.

edited Feb 22 '13 at 12:19

PeeHaa

71,436
58
190
262

answered Nov 12 '11 at 18:37

CodesInChaos

106,488
23
218
262

I hate single quoted attributes :) Thanks for the heads up on the JS part since it will be the case in some point in the future. – PeeHaa Nov 20 '11 at 14:11

score 3 · Answer 2 · answered Nov 12 '11 at 18:36

No, it's not sufficient in all situations. It highly depends on your codebase. For example, if you use JavaScript to make certain AJAX requests to a database, htmlspecialchars() will sometimes not be enough (depending where you use it). If you want to protect cookies from JavaScript XSS, htmlspecialchars() will also not be good enough.

Here are some examples of when htmlspecialchars() may fail: https://www.owasp.org/index.php/Interpreter_Injection#Why_htmlspecialchars_is_not_always_enough. Your question is also highly dependent on what database you're using (not everyone uses MySQL). If you're writing a complex applicaton I highly suggest using one of the many frameworks out there that abstract these annoying little idiosyncrasies and let you worry about the application code.

Why is the database relevant? DB access and encoding output are separate concerns. — CodesInChaos, Nov 12 '11 at 18:42
As far as Postgres is concerned it doesn't matter (they both use SQL) - but some databases don't use SQL. — David Titarenco, Nov 12 '11 at 18:47

score 2 · Answer 3 · answered Nov 12 '11 at 18:36

Using htmlspecialchars is sufficient when inserting inside HTML code. The way it encodes the characters makes it impossible for the resulting text to “break out” of the current element. That way it can neither create other elements, nor script segments etc.

However in all other situations, htmlspecialchars it not automatically enough. For example when you use it to insert code within some JavaScript area, for example when you fill a JavaScript string with it, you will need additional methods to make it safe. In that case addslashes could help.

So depending on where you insert the resulting text, htmlspecialchars gives you either enough security or not. As the function name already suggests, it just promises security for HTML.

score 1 · Answer 4 · answered Nov 12 '11 at 18:35

1

htmlspecialchars will suffice. With < and > being converted to < and > you cannot include scripts anymore.

answered Nov 12 '11 at 18:35

GolezTrol

114,394
18
182
210

1

Depends on where the user text is inserted into the html. If it's outside a tag/script it will be enough. – CodesInChaos Nov 12 '11 at 18:40
True, forgot to mention that. If you don't want the content to be interpreted as a script, you should not include it in script tags. – GolezTrol Nov 12 '11 at 18:44
Not true for attribute values. – Kzqai Aug 28 '12 at 20:44

Is using htmlspecialchars() sufficient in all situations?

4 Answers4