|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2019-11-14 12:16 UTC] talkemade at computest dot nl
Description:
------------
When strip_tags is used with a whitelist of tags, php allows slashes ("/") that occur inside the name of a whitelisted tag and copies them to the result.
For example, if <strong> is whitelisted, then a tag <s/trong> is also kept.
The browsers Chrome, Firefox and Safari, however, interpret this syntax as <s trong=""> (in HTML this would result in a strikethrough element with an unknown attribute). This means that it's possible to use any tag which is a prefix of a tag that is whitelisted. If the whitelist is important for security then this can allow the introduction of non-whitelisted tags.
Test script:
---------------
<?php
echo strip_tags("<s/trong>b</strong>", "<strong>");
Expected result:
----------------
b
Actual result:
--------------
<s/trong>b</strong>
PatchesPull Requests
Pull requests:
HistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 14:00:01 2025 UTC |
Okay, lets consult the docs[1]: | This function should not be used to try to prevent XSS attacks. So this is clearly not a security issue. I agree, though, that the reported behavior is erroneous, but would expect the following output b</strong> [1] <https://www.php.net/strip_tags>