Outputting a SESSION following user input - protect against xss

Question

I have this code to echo out a username of a user that has just logged in:

echo $_SESSION['user']['username']."

Would I be right in thinking that if I change my code to:

echo htmlspecialchars $_SESSION['user']['username']."

i am protecting myself from low level XSS atleast?

Answer 1

That depends on where you output the username. If it's between html tags, yes. If it's in an html attribute, it depends on the attribute. See the OWASP XSS prevention cheat sheet.

Answer 2

The function htmlspecialchars does not encode single quotation(') by default, if your user name echo in an html attribute or inside javascript, there would be XSS!

For example:

<script>
name='$YOUR_NAME_HERE$';
</script>

We can set the user name to ';alert('xss');// So the browser will generate the html content like this

<script>
name='';alert('xss');//';
</script>

And my advice to you is:

echo htmlspecialchars($_SESSION['user']['username'], ENT_QUOTES);