PHP Security test gives me critical Reflected XSS warning for GetHTMLValueString, how can i fix?

CodePudding user response：

Try convert value to HTML Entities

<?php $depo_gin = '<a>1</a>'; ?>
<td>...</td><td><?php echo htmlentities( GetHTMLValueString($depo_gin) ); ?></td>

OR

<?php $depo_gin = '<a>1</a>'; ?>
<td>...</td><td><?php echo htmlspecialchars( GetHTMLValueString($depo_gin) ); ?></td>

Result in HTML:

<td>...</td><td>&lt;a&gt;1&lt;/a&gt;</td>

Docs:

https://www.php.net/manual/en/function.htmlentities.php

https://www.php.net/manual/en/function.htmlspecialchars.php

If you need only value from html content

Try use function strip_tags

<?php 

var_dump(
  strip_tags('<a>1</a>')
); # result: 1

https://www.php.net/manual/en/function.strip-tags