Reflected XSS Echo

Vulnerable vs. safe

echo $name;

echo htmlspecialchars($name, ENT_QUOTES, 'UTF-8');

Why it matters & how to fix it

A request parameter is echoed into the HTTP response without output encoding, causing reflected cross-site scripting (CWE-79). Encode all untrusted output with htmlspecialchars($v, ENT_QUOTES, 'UTF-8') for HTML body context (and use context-appropriate encoding for attributes, JS, or URLs). In templates, prefer auto-escaping engines (Blade {{ }}, Twig).

References

• https://owasp.org/www-community/attacks/xss/
• https://cwe.mitre.org/data/definitions/79.html

Related checks

• JavaScript / TypeScript - Other Security Checks
  Child Process Shell True
• JavaScript / TypeScript - Other Security Checks
  Open Redirect Tainted Input
• Python - Other Security Checks
  Django Mark Safe
• Python - Other Security Checks
  Flask Debug Enabled
• Python - Other Security Checks
  Flask Render Template String
• Python - Other Security Checks
  Insecure Tempfile Mktemp