Intentionally vulnerable application for controlled security education.
Submit a comment and observe how it is rendered.
For example:
<script>alert('Local XSS demo')</script>
Or a non-popup demonstration:
<script>document.body.dataset.xssDemo='executed';</script>
These examples only demonstrate JavaScript execution in this local page.
Data is supplied through the URL and immediately reflected.
<script>alert('Reflected XSS')</script>
In Vulnerable Mode, the server places this user-controlled value directly into the HTML response.
Comments are persisted in MySQL and rendered below.
Secure Mode still receives the same user-controlled input, but it encodes special HTML characters before displaying it.
For example, characters such as
< and > are represented as
HTML entities rather than being interpreted as HTML markup.
Consequently, the browser displays the payload as text instead of treating it as executable HTML.
Treat all user-controlled data as untrusted when it crosses into an HTML context.
htmlspecialchars(
$value,
ENT_QUOTES | ENT_SUBSTITUTE,
'UTF-8'
);
Output encoding is context-dependent. This example protects values being placed into normal HTML text or attribute contexts. Other contexts, such as JavaScript, CSS, URLs, or SQL, require their own appropriate handling.
The database layer also uses PDO prepared statements so the demonstration does not unnecessarily introduce SQL injection.