XSS (Cross-Site Scripting) ni attack ambapo attacker anaingiza malicious scripts kwenye input fields au URLs, na scripts hizi zinaweza kutekelezwa kwenye browser ya user mwingine.
Solution: Use htmlspecialchars() ili ku-convert characters hatari kuwa safe HTML entities.
Characters zinazobadilishwa:
Character Converted to
& &
" "
' '
< <
> >
⚙️ 2. Example HTML Form
<h2>Comment Form</h2>
<form action="comment.php" method="POST">
<input type="text" name="username" placeholder="Your Name" required><br><br>
<textarea name="comment" placeholder="Your Comment" required></textarea><br><br>
<button type="submit" name="submit">Submit</button>
</form>
Inputs kutoka user lazima zisafishwe kabla ya ku-display.
🧩 3. PHP Example (comment.php)
<?php
if(isset($_POST['submit'])){
// Sanitize inputs to prevent XSS
$username = htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8');
$comment = htmlspecialchars($_POST['comment'], ENT_QUOTES, 'UTF-8');
// Display safely
echo "<p><strong>$username</strong>: $comment</p>";
}
?>
💡 Maelezo:
ENT_QUOTES inablock quotes pia (" na ').
'UTF-8' ensures proper encoding for all characters.
User cannot inject <script>alert('XSS')</script> because it becomes <script>alert('XSS')</script>.
🔑 4. Best Practices
Always escape output – before displaying any user input in HTML.
Combine with input sanitization – trim(), strip_tags() kwa extra safety.
Use on all dynamic content – comments, usernames, messages.
Do not rely only on client-side validation – server-side is crucial.
Consider Content Security Policy (CSP) – extra layer of defense against XSS.
✅ 5. Hitimisho
htmlspecialchars() ni simple lakini powerful tool kuzuia XSS attacks.
Always escape output, even if you validated input.
Combine with input sanitization, validation, na secure coding practices kwa maximum protection.
🔗 Tembelea:
👉 https://www.faulink.com/
Kwa mafunzo zaidi ya PHP, XSS prevention, na secure web application development.