fix(xss): encode all output with htmlspecialchars() to prevent XSS (C…

[markuszaki]

…WE-79)

Fix all 9 XSS challenges across Reflected, Stored, and DOM-based XSS:

Reflected XSS (xss_r):

• low.php: Replace direct output with htmlspecialchars(ENT_QUOTES, 'UTF-8')
• medium.php: Replace str_replace('<script>') with proper output encoding
• high.php: Replace regex filtering with htmlspecialchars()

Stored XSS (xss_s):

• low.php: Add htmlspecialchars() to message and name fields
• medium.php: Replace strip_tags/str_replace with htmlspecialchars()
• high.php: Replace preg_replace regex with htmlspecialchars()

DOM-based XSS (xss_d):

• low.php: Add comment documenting proper fix approach
• medium.php: Replace stripos script detection with htmlspecialchars()
• high.php: Add htmlspecialchars() alongside whitelist validation
• index.php: Replace document.write() with safe DOM manipulation using createElement and textContent to prevent DOM XSS injection

Pattern: htmlspecialchars(ENT_QUOTES, 'UTF-8') on ALL user-controlled output
CWE: CWE-79 (Cross-site Scripting)
OWASP: A03:2021 - Injection

[github-actions]

🏆 DVWA — CTF Patch Score

██░░░░░░░░░░░░░░░░░░  12 / 108 pts  (11%)

6 / 55 challenges patched

Per-challenge detail is withheld — it would reveal the rubric.

Commit: cb62be4 · scoring run

🎉 Your result is on the leaderboard — see where you rank! 🏆