如何使用PHP防止URL表单字段中的HTML注入？

Question

For example if I am colecting a [URL value] in a form, saving that [URL value] in a database, and then using it in a page like this:

<a href="[URL value]" > The Link </a>

How do I protect against this [URL value]:

http://www.somelink.com"> Evil text or can be empty </a>  ALL THE EVIL HTML I WANT  <a href="

How can I protect against this kind of HTML injection for URL form fileds without breaking the URL in case it is valid ?

Answer 1

When receiving the URL on the form:

• Use filter_var(url, FILTER_VALIDATE_URL) to ensure the URL is in a valid format.
• Ensure the URL starts with http:// or https:// (or at least reject all javascript: URL as they can include malignant code)
• Use prepared statements when inserting the URL (and other form data) in the database or properly escape that data to prevent SQL injections.

When displaying the page:

• Use htmlspecialchars() to escape the URL (and all other text) that you insert in the HTML.