WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code.

In his presentation he gives the following example:


    $title = "<script> alert( 'Hello Europe!' );</script>";

<h1><?php echo $title; ?></h1>


    $title = "<script> alert( 'Hello Europe!' );</script>";

<h1><?php echo esc_html( $title ); ?></h1>

Although I realise that this is a very simple example, my question is how - or perhaps more important when - would someone be able to add something like <script> alert( 'Hello Europe!' );</script> in the first place?

share|improve this question

closed as off-topic by vancoder, s_ha_dum, Wyck, brasofilo, Rarst Oct 16 '13 at 8:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should be specific to WordPress within defined scope (merely happening in its context, such as generic PHP/JS/HTML/CSS, is insufficient). Might be better asked at Stack Overflow or other appropriate site of Stack Exchange network." – vancoder, s_ha_dum, Wyck, brasofilo, Rarst
If this question can be reworded to fit the rules in the help center, please edit the question.

Hi Piet, this is off-topic since XSS affects any client-side scripts and not just WordPress ones. Your best off using Google or YouTube for some basics on how XSS works and then reading this comprehensive list: owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet – Wyck Oct 16 '13 at 2:42
allright, will try to find info on it on my own then. Thanks for the link – Piet Oct 16 '13 at 3:32
You can drop into chat chat.stackexchange.com/rooms/6/the-loop and well...chat, I'm usually in there during the day. – Wyck Oct 16 '13 at 3:39
the WordPress context lies in the fact that (see my comment on @Sander Koedood) it seems that WordPress already strips out "dangerous" strings, whether a developer escapes the strings or not. – Piet Oct 16 '13 at 16:08
XSS is client based (generally speaking), a hacker does not need access to your site, so if a theme or plugin is not escaping javascript they can XSS the browser, this is very common with themes and plugins, much more than I think people realize. – Wyck Oct 17 '13 at 5:29

Though I am no expert in XSS, I do know some of the ways someone can abuse these techniques.

For example, I was once pointed to the fact that visitors were able to execute javascript via the search field of a website, because the input of the search field didn't get stripped of it's html tags (like the example above actually does). This way, people were able to get valuable information about the server, by executing certain scripts via the search field.

As I said, I am no expert, so I don't know what can actually be achieved through XSS. I do know you're better of securing your website from the risk of finding out.

Apart from that, Google is your best friend.

I hope this was helpfull, good luck!

share|improve this answer
Thanks for your input Sander. Your example (input field for Search) is a good one, but those type of fields are already secured by WordPress Core by default, right? Today I tried to put scripts in a few widgets I developed without escaping code in mind while I was developing, but also there WordPress just strips out the "dangerous" parts. Hence my original question: if Core already protects everything no matter whether you escape strings in your plugins or not, then what is all the fuss about? Of course at the same time I appreciate there are exceptions, depending on the type of plugin... – Piet Oct 16 '13 at 16:05
As a matter of fact, the wordpress installation where the search field was an issue, was at least a WordPress 3.3 version. I'm not sure whether it has actually been protected by now, since I regret to say that I'm not developing in WordPress very much anymore lately. Worth checking out maybe... – Sander Koedood Oct 16 '13 at 16:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.