How to Prevent XSS (Cross-Site Scripting) in PHP

Cross‑Site Scripting (XSS) remains one of the most common security vulnerabilities in web applications. When an attacker injects malicious JavaScript into a page viewed by other users, they can steal cookies, hijack sessions, or manipulate the DOM. PHP developers have a toolbox of built‑in functions and best‑practice patterns that can dramatically reduce the risk of XSS.

1. Understand the Types of XSS

Stored XSS

Malicious code is saved on the server (e.g., in a database) and rendered every time the vulnerable page loads.

Reflected XSS

The payload is reflected off the server in an immediate response, often via query strings or form parameters.

DOM‑Based XSS

The vulnerability lives entirely in client‑side JavaScript, manipulating the DOM based on untrusted data.

Knowing which type you’re defending against guides the choice of mitigation techniques.

2. Validate & Sanitize Input

Never trust data that comes from users, APIs, or third‑party services.

Whitelist validation: Accept only the characters or patterns you expect. For example, use filter_var($email, FILTER_VALIDATE_EMAIL) for email fields.
Use PHP’s filter extension for common data types (emails, URLs, integers, etc.).
Reject or escape everything else before processing or storing it.

3. Encode Output Properly

Encoding is the most reliable defense because it neutralizes any script tags that might have slipped through validation.

HTML Context

echo htmlspecialchars($userInput, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

htmlspecialchars() converts <, >, &, ", and ' to their HTML entities, making them harmless.

JavaScript Context

echo json_encode($userInput, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_AMP | JSON_HEX_QUOT);

When inserting data inside a <script> block, use json_encode() with the HEX options to escape characters that could break out of the script.

URL Context

echo rawurlencode($userInput);

HTML Attribute Context

echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');

4. Adopt a Content Security Policy (CSP)

A well‑configured CSP acts as a second line of defense by restricting where scripts can be loaded from.

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://trusted.cdn.com; object-src 'none';">

Key directives:

script-src – allow scripts only from trusted origins.
object-src 'none' – block Flash/Java applets.
base-uri 'self' – limit the <base> tag.

5. Use HTTP‑Only and Secure Cookies

Mark session cookies with the HttpOnly flag to prevent JavaScript access, and use Secure to ensure they are only sent over HTTPS.

setcookie('PHPSESSID', $sessionId, [
    'httponly' => true,
    'secure'   => true,
    'samesite' => 'Strict',
]);

6. Leverage Modern PHP Frameworks

Frameworks such as Laravel, Symfony, and Slim come with built‑in XSS protection:

Automatic output escaping in Blade (Laravel) and Twig (Symfony).
Request validation classes that enforce whitelist rules.
Middleware for adding CSP headers.

7. Perform Regular Security Testing

Static analysis: Tools like PHPStan or Psalm can spot unsafe functions.
Dynamic scanning: OWASP ZAP, Burp Suite, or Nikto to simulate XSS attacks.
Pen‑testing: Conduct manual tests, especially on forms, search fields, and comment sections.

8. Keep PHP and Dependencies Updated

Security patches often address newly discovered XSS vectors. Use Composer’s composer update regularly and monitor CVE databases.

9. Summary Checklist

Validate & whitelist all user input.
Escape output with htmlspecialchars(), json_encode(), or appropriate functions for the context.
Implement a strict Content Security Policy.
Set HttpOnly, Secure, and SameSite cookie attributes.
Use a modern framework that handles encoding automatically.
Run static and dynamic security scans on a regular schedule.
Stay current with PHP and library updates.

By integrating these practices into your development workflow, you can dramatically lower the risk of XSS attacks and protect both your users and your brand reputation.