XSS (Cross-Site Scripting): Mwongozo wa Kuzuia kwa Developers wa PHP

Short intro (kuanza makala):
XSS ni moja ya tishio kubwa kwenye web applications: wadukuzi wanaingiza JavaScript hatari au HTML ambayo hutekelezwa kwa browser ya watumiaji. Hii makala itakuonyesha aina za XSS (reflected, stored, DOM), dalili za kushangaa, na suluhisho za vitendo kwa PHP na JavaScript — pamoja na code za copy & paste unazoweza kutumia sasa.

Key points to cover (bullets):

Aina za XSS: Reflected, Stored, DOM-based.

Kanuni ya msingi: Validate input, Escape output, Use CSP.

Tumia htmlspecialchars() kwa output escaping kwenye PHP.

Tumia prepared statements kwa database; usihifadhi raw HTML bila kusafisha.

Pata balance ya permissive rich text (kama editor) kwa kutumia sanitizer server-side (e.g., HTMLPurifier) au client-side DOMPurify.

Set CSP headers na httponly cookies.

Test kwa OWASP ZAP au Burp Suite (defensive testing kwenye dev env tu).

3) Code (Kazi, copy & paste) — PHP + JS snippets
A. Basic output escaping (safest, use everywhere)

B. Escaping data from DB (prepared statement + escape)

prepare("SELECT comment FROM comments WHERE id = ?");
$stmt->bind_param('i', $id);
$stmt->execute();
$result = $stmt->get_result();
$row = $result->fetch_assoc();
if ($row) {
echo nl2br(htmlspecialchars($row['comment'], ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'));
}
$stmt->close();
$conn->close();
?>

C. Content Security Policy (CSP) header (basic strong policy)

Kwa apps zinahitaji inline scripts/styles unaweza tumia nonces/strict-dynamic, lakini hiyo inahitaji utaratibu zaidi.

D. Sanitizing rich HTML server-side (example using HTMLPurifier style pseudocode)

set('HTML.SafeIframe', true);
$purifier = new HTMLPurifier($config);

$raw_html = $_POST['content'] ?? '';
$clean_html = $purifier->purify($raw_html);

// store $clean_html safely in DB
?>

Note: HTMLPurifier ni library ya PHP inayotumika sana kwa sanitization; kama huna, tumia approach ya stripping to allowlist tags.

E. Client-side: Use DOMPurify before inserting HTML (if you must render user-supplied HTML)

Always sanitize on server first — client-side sanitizing is defense-in-depth only.

F. Example: safe comment submission (CSRF token + escape)