XSS attack from url get variable

Question

I have a site fetch data from database and create a links to next page

The links page will required page_id and it will display title on url bar

<a href=example.php?page=2&title=foo">click</a>

The URL will display:

example.php?page=2&title=foo

page_id will be number only but title can be anything.

My questions are:

• What if user save javascript:alert() into title?
• Will it run script from URL?
• Is there anything else I should take care of?

Answer 1

you should use:

• urlencode to encode query parameters,
• htmlspecialchars to escape content typed by user inside html
• binding parameters to sql statements to avoid sql injection
  ( http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php )

Answer 2

浏览器不应该也不应（至少IE11不会）执行onclick属性中的javascript。