What potential security risks are involved in directly outputting a $_GET parameter in PHP?

Directly outputting a $_GET parameter in PHP can pose a security risk known as Cross-Site Scripting (XSS). This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. To prevent this, you should always sanitize and validate user input before displaying it on a webpage. 

<?php
// Sanitize and validate the $_GET parameter before outputting it
$param = isset($_GET['param']) ? htmlspecialchars($_GET['param']) : '';
echo $param;
?>

Keywords

XSS SQL injection input validation htmlentities htmlspecialchars

Related Questions