PHP Strings — XSS from Unescaped Product Descriptions

<?php

// --- Single-quoted string: PHP takes it literally ---
$productName = 'Wireless Headphones';

// --- Double-quoted string: PHP replaces $productName with its value ---
$welcomeMessage = "Thank you for purchasing $productName!";

// --- Concatenation: joining two strings using the dot (.) operator ---
$firstName = 'Sarah';
$lastName  = 'Connor';
$fullName  = $firstName . ' ' . $lastName; // dot joins them with a space

// --- Heredoc: great for multi-line strings (note: no indent before closing label) ---
$emailBody = <<<EOT
Dear $firstName,

Your order for $productName has been confirmed.
Thank you for shopping with us!

EOT;

// --- Print results ---
echo $welcomeMessage . "\n";
echo $fullName . "\n";
echo $emailBody;

<?php

$userInput = '   Hello, World!   ';
$articleTitle = 'php strings are powerful';
$emailAddress = 'user@example.com';
$productDescription = 'The quick brown fox jumps over the lazy dog.';

// ── MEASURING ───────────────────────────────────────────────

// strlen() counts how many characters are in the string (spaces included)
$rawLength = strlen($userInput); // 21 (includes the leading/trailing spaces)

// ── TRIMMING ────────────────────────────────────────────────

// trim() strips whitespace from both ends — classic for cleaning form input
$cleanInput = trim($userInput); // 'Hello, World!'
$trimmedLength = strlen($cleanInput); // 13

// ── CASE TRANSFORMATIONS ────────────────────────────────────

// strtoupper() makes every letter a capital
$shoutedTitle = strtoupper($articleTitle); // 'PHP STRINGS ARE POWERFUL'

// strtolower() makes every letter lowercase — useful before comparisons
$lowerEmail = strtolower($emailAddress); // 'user@example.com'

// ucwords() capitalises the first letter of every word — great for display names
$formattedTitle = ucwords($articleTitle); // 'Php Strings Are Powerful'

// ── SEARCHING ───────────────────────────────────────────────

// strpos() finds the position (index) of the FIRST occurrence of a substring
// Returns FALSE if the substring isn't found — note: position 0 is the very first character
$foxPosition = strpos($productDescription, 'fox'); // 16

// str_contains() (PHP 8+) — returns true/false, much more readable for simple checks
$hasFox = str_contains($productDescription, 'fox'); // true

// ── REPLACING ───────────────────────────────────────────────

// str_replace() swaps out every occurrence of a word for another
$updatedDescription = str_replace('lazy', 'energetic', $productDescription);
// 'The quick brown fox jumps over the energetic dog.'

// ── SLICING ─────────────────────────────────────────────────

// substr() extracts a portion of a string: substr(string, start, length)
$domain = substr($emailAddress, 5); // 'example.com' — starts from index 5
$tld    = substr($emailAddress, -3); // 'com' — negative index counts from the end

// ── SPLITTING ───────────────────────────────────────────────

// explode() splits a string into an array using a delimiter
$emailParts = explode('@', $emailAddress); // ['user', 'example.com']
$username   = $emailParts[0]; // 'user'

// ── OUTPUT RESULTS ──────────────────────────────────────────
echo "Raw length (with spaces): $rawLength\n";
echo "Trimmed: '$cleanInput' — Length: $trimmedLength\n";
echo "Shouted: $shoutedTitle\n";
echo "Formatted: $formattedTitle\n";
echo "'fox' found at position: $foxPosition\n";
echo "Contains 'fox': " . ($hasFox ? 'Yes' : 'No') . "\n";
echo "Updated: $updatedDescription\n";
echo "Domain: $domain\n";
echo "TLD: $tld\n";
echo "Username from email: $username\n";

<?php

$itemName     = 'Mechanical Keyboard';
$itemPrice    = 149.9;  // raw price from database
$itemQuantity = 3;
$taxRate      = 0.08;   // 8% tax

// ── number_format() ─────────────────────────────────────────
// number_format(number, decimal_places, decimal_separator, thousands_separator)
$formattedPrice = number_format($itemPrice, 2); // '149.90'

$largeAmount = 1999999.5;
$readableAmount = number_format($largeAmount, 2, '.', ','); // '1,999,999.50'

// ── sprintf() ───────────────────────────────────────────────
// %s = string placeholder, %.2f = float with 2 decimal places, %d = integer
$receiptLine = sprintf(
    '%d x %s @ $%.2f each',
    $itemQuantity,   // fills %d
    $itemName,       // fills %s
    $itemPrice       // fills %.2f
);
// Result: '3 x Mechanical Keyboard @ $149.90 each'

// Calculating and formatting a total with tax
$subtotal  = $itemPrice * $itemQuantity; // 449.70
$taxAmount = $subtotal * $taxRate;       // 35.976
$total     = $subtotal + $taxAmount;     // 485.676

$receiptSummary = sprintf(
    "Subtotal: $%.2f\nTax (8%%): $%.2f\nTotal:    $%.2f",
    $subtotal,
    $taxAmount,
    $total
    // Note: %% prints a literal percent sign — a single % would confuse sprintf
);

// ── OUTPUT ──────────────────────────────────────────────────
echo $receiptLine . "\n";
echo $receiptSummary . "\n";
echo "Large amount formatted: $" . $readableAmount . "\n";

<?php

// ── BASIC REPLACEMENT ───────────────────────────────────────

$blogTemplate = 'Welcome to [site-name]! Written by [author-name] on [date].';

// str_replace can accept arrays to do multiple replacements in one call
$published = str_replace(
    ['[site-name]', '[author-name]', '[date]'],   // search for these
    ['TheCodeForge', 'Alice Merritt', 'June 2025'], // replace with these
    $blogTemplate                                   // in this string
);
// Result: 'Welcome to TheCodeForge! Written by Alice Merritt on June 2025.'

// ── CASE-INSENSITIVE REPLACEMENT ────────────────────────────

$userComment = 'I love PHP! PHP is awesome. php rocks.';

// str_ireplace() is case-insensitive — it catches 'PHP', 'php', 'Php', etc.
$censoredComment = str_ireplace('php', '***', $userComment);
// Result: 'I love ***! *** is awesome. *** rocks.'

// ── SECURITY: Sanitising user input before display ───────────

$maliciousInput = '<script>alert("You have been hacked!");</script>';

// htmlspecialchars() converts < > " & into safe HTML entities
// This stops the browser from executing the script tag
$safeOutput = htmlspecialchars($maliciousInput, ENT_QUOTES, 'UTF-8');
// Result: '&lt;script&gt;alert(&quot;You have been hacked!&quot;);&lt;/script&gt;'
// The browser displays it as plain text — not an executable script

// ── SIMPLE REGEX EXAMPLE: Validate an email ─────────────────

$emailToCheck = 'contact@thecodeforge.io';

// preg_match() returns 1 if pattern matches, 0 if not
// FILTER_VALIDATE_EMAIL is PHP's built-in email validator (simpler than raw regex)
$isValidEmail = filter_var($emailToCheck, FILTER_VALIDATE_EMAIL);

// ── OUTPUT ──────────────────────────────────────────────────
echo $published . "\n";
echo $censoredComment . "\n";
echo "Safe output: " . $safeOutput . "\n";
echo "Is email valid: " . ($isValidEmail ? 'Yes' : 'No') . "\n";

<?php

// ── BASIC STRING COMPARISON ─────────────────────────────────

$value1 = '123';
$value2 = 123;

var_dump($value1 == $value2);  // bool(true) — loose comparison
var_dump($value1 === $value2); // bool(false) — strict comparison

// strcmp for binary-safe string comparison
$strA = 'apple';
$strB = 'banana';
$result = strcmp($strA, $strB); // negative (-1): 'apple' < 'banana'
echo "strcmp result: $result\n";

// ── MULTIBYTE FUNCTIONS ─────────────────────────────────────

$emoji = '😀';
$accent = 'café';

echo "strlen of emoji: " . strlen($emoji) . "\n";        // 4 (bytes)
echo "mb_strlen of emoji: " . mb_strlen($emoji) . "\n"; // 1 (character)

// mb_strtolower for proper case folding
$mixed = 'CAFÉ';
echo strtolower($mixed) . "\n";                // 'cafÉ' (accent untouched)
echo mb_strtolower($mixed) . "\n";            // 'café' (correct)

// mb_substr for safe slicing
$text = '日本語';
echo substr($text, 1, 1) . "\n";              // garbage byte
echo mb_substr($text, 1, 1) . "\n";          // '本'

// ── NATURAL SORTING ─────────────────────────────────────────

$files = ['img10.jpg', 'img2.jpg', 'img1.jpg'];
natsort($files); // sorts naturally: img1, img2, img10
print_r($files);

// ── OUTPUT ──────────────────────────────────────────────────
echo "\nDone.\n";

<?php
$input = "O'Reilly \ "Best" PHP Guide";

// addslashes: broad, no control
echo addslashes($input) . "\n";
// O\'Reilly \\ \"Best\" PHP Guide

// addcslashes: target only what needs escaping
echo addcslashes($input, "'") . "\n";
// O\'Reilly \ "Best" PHP Guide

<?php
// Safe one-pass replacement with strtr
$template = "Hello {{name}}, your order #{{order_id}} is ready.";
$replacements = [
    '{{name}}' => 'Alice',
    '{{order_id}}' => 'ORD-2024-001',
];
echo strtr($template, $replacements);

// Output: Hello Alice, your order #ORD-2024-001 is ready.

// Precise position replacement with substr_replace
$card = "4111-1111-1111-1111";
$redacted = substr_replace($card, "****-****-****-", 0, 14);
echo $redacted;
// Output: ****-****-****-1111