需要帮助纠正我的代码中的XSS漏洞

Question

It was brought to my attention that my image popup code is subject to an XSS attack.. I understand the issue, but as PHP is not my area of expertise, I am not sure how to correct it.. I've done a fair bit of searching here, but still am not fully clear on HOW to fix my code.

Here's the code that is problematic:

<?php
  echo '<a href="javascript:window.close()">' . zen_image($_GET['products_image_large_additional'], $products_values->fields['products_name'] . ' ' . TEXT_CLOSE_WINDOW) . '</a>';
?>

How do I correct this code to correct the XSS vulnerability in it??

Answer 1

You're obviously getting the product's data on the server-side
( $products_values->fields['products_name'] ), so why not get the image in the same way instead of passing it through $_GET ? That should fix your problem.

Answer 2

I'm not sure what zen_image expects/does, but you could escape the GET variables before passing them to the function.

<?php
    echo '<a href="javascript:window.close()">' . zen_image(strip_tags($_GET['products_image_large_additional']), $products_values->fields['products_name'] . ' ' . TEXT_CLOSE_WINDOW) . '</a>';
?>

I used the function strip_tags to remove any HTML tags.