Is there a way to prevent user from entering <img src=x onerror=alert(test)> script tag to the form? My current search page is using ajax to load search result upon entering on the input field. I have look into sanitize function but still not able to resolve.

I have also installed the plugin: Prevent XSS Vulnerability

Here is the form:

<form action="#" id="general-search" autocomplete="off" class="mx-auto">
                <div class="d-md-inline-block d-block position-relative ml-auto mr-md-3 mb-md-0 mb-2 mr-md-0 mr-auto input-wrap"><input type="hidden" name="tag" value="<?php echo $tag;?>" />
                <input type="text" name="search_keyword" placeholder="Search here..." value="<?php echo $keyword;?>"/><span id="clear-search"><img src="<?php echo theme_url_images;?>cancel-gray.png" /></span></div><a href="#" class="btn btn-medium btn-red mx-md-0 mx-auto d-md-inline-block d-block ajax-search mt-md-0 mt-4">Submit (test)</a>


  • Usually escaping is what would solve this, but there's no code in your question to work with. Also, are you aware of the search REST API endpoint? Why build a custom AJAX search handler when you can use the one provided by core
    – Tom J Nowell
    Aug 31 at 10:20
  • @TomJNowell I have added snippet of my code, also can advise on the search rest API?
    – Daryl Liu
    Aug 31 at 15:34
  • 1
    No escaping functions are being used in that code. if this were a standard WP search form then get_search_query would escape internally for you developer.wordpress.org/reference/functions/get_search_query. Otherwise you will need to use escaping functions to escape the output and solve your problem.
    – Tom J Nowell
    Aug 31 at 15:37

Is there a way to prevent user from entering script tag to the form?

Yes, escaping. It is one of the fundamental cornerstones of web security, and completely missing from the code in the question.

Take this example:

<a href="<?php echo $foo; ?>">

How do we know it's actually a URL? Your colleague has said it should be a URL, but do we really know for sure? What if we got hacked?

Escaping allows us to guarantee it will always be a URL. Even if $foo contains javascript code, a phone number, PI to 300 digits, doesn't matter. Escaping enforces expectations, even if the result is broken and mangled, it's guaranteed to be a URL.

<a href="<?php echo esc_url( $foo ); ?>">

Now we can rest safely assured that nothing can break out of the href attribute, that the anchor tag won't be used to insert arbitrary HTML. It might contain a malicious URL, but it will always be a URL ( http://img%20src=x%20onerror=alert(test) ).

Escape right at the moment of output or as close as is possible.

There are lots of other escaping functions provided by WordPress and by PHP, each appropriate for different situations, such as plaintext, numbers, etc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.