redirects using htmlspecialchars/htmlentities

Question

I have this kind fo redirects now

Redirect::to(htmlspecialchars('home.php'));

but when I type this on my home.php: /%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E

it results like this:

but why ? they said that it will converted so the exploit attempt will be a failure, but why in mine it is not ?

Answer 1

htmlspecialchars encodes special characters to their HTML equivalent in a string which is passed by argument. Your Code

Redirect::to(htmlspecialchars('home.php')); 

only encodes the string home.php and pass it to the Redirect::To -Function and does not use htmlspecialchars on the output of the whole page.

To solve this, you have to use it on every output in home.php like this:

<?php
$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);
echo $new; // &lt;a href=&#039;test&#039;&gt;Test&lt;/a&gt;
?>

(Example from: http://php.net/htmlspecialchars )