Why should $_GET and $_POST values never be outputted unfiltered, especially within JavaScript?

$_GET and $_POST values should never be outputted unfiltered, especially within JavaScript, because it can make your application vulnerable to Cross-Site Scripting (XSS) attacks. To prevent this, you should always sanitize and escape user input before outputting it to the browser. This can be done using functions like htmlspecialchars() or htmlentities() in PHP. 

// Sanitize and escape user input before outputting it within JavaScript
$value = htmlspecialchars($_GET['value'], ENT_QUOTES, 'UTF-8');
echo "<script> var value = '" . $value . "'; </script>";

Keywords

$_GET $_POST filtering security JavaScript

Related Questions