title: XSS in text-fields - PHP example
body: <p>Please consider this PHP page below, named xss1.php. You can upload it to any LAMP server or VM you have, to understand my conundrum.</p>
  
  <pre><code>&lt;?php
  ob_start();
  
  session_start();
  
  $searchValue = "";
  
  if ($_SERVER["REQUEST_METHOD"] === "POST") {
      $searchValue = trim($_POST["txtSearch"]);
  }
  ?&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html lang="en"&gt;
    &lt;head&gt;
      &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /&gt;
      &lt;title&gt;XSS: Sample 1&lt;/title&gt;
    &lt;/head&gt;
    &lt;body&gt;
      &lt;form name="xssForm" method="POST" action="xss1.php"&gt;
        &lt;input type="text" id="txtSearch" name="txtSearch" maxlength="128" value="&lt;?php print($searchValue); ?&gt;"/&gt;
        &lt;input type="Submit" id="btnSubmit" value="Submit"/&gt;
      &lt;/form&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  &lt;?php
  ob_end_flush();
  ?&gt;
  </code></pre>
  
  <p>I was under the impression, data in text-fields are displayed as is, and need minimal or no-XSS checking. In this text-field, If I were to stick in <b>&lt;script&gt;alert(1);&lt;/script&gt;</b> and the form gets posted, the value gets displayed back in the text-field again, with no XSS execution or injection. I'm running Firefox 50.0.2. on my Mac OS X.</p>
  
  <p>Now, if I stick in <b>&quot;&gt;&lt;script&gt;alert(1);&lt;/script&gt;</b>, there is XSS and I see a Javascript alert pop-out with 1 in it. The characters &quot;/&gt; come after the text-field, rendered as text on the page, not inside the text-field. What changed here? I'm a little perplexed and will perhaps spend the next hour trying to find the answer on XSS Filter Evasion Cheat Sheet, at <a href="https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet" rel="nofollow noreferrer">https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet</a></p>
  
  <p>In Safari though, I don't see the Javascript alert pop-out, but &quot;/&gt; gets written outside the text-field, right after it on the page.</p>
  
  <p>It's 2:01 am PT and I'm Sleepless in Seattle :)</p>