Why PHP_SELF Should Be Avoided When Creating Website Links

When looking for articles about PHP_SELF, it seems like most only refer to the dangers of using the variable with HTML forms. However, there are risks with using it in other parts of a website. For example, it may be tempting to use the variable within the href attribute for links. The problem is that those links become susceptible to Cross-Site Scripting (XSS). Let's take a closer look at the security vulnerability of PHP_SELF and a simple alternative to avoid the problem altogether.

Purpose of PHP_SELF

For those unfamiliar, PHP_SELF is a server variable typically used in PHP scripts to link one page to itself. For example, a page may initially display a list of products with links for viewing more information about each item. If a link is clicked, an ID is passed to the same page for displaying the product details.

The Problem

As shown in the video, using PHP_SELF for links isn't recommended due to being vulnerable to Cross-Site Scripting (XSS). For example, let's say our page (http://www.example.com/products.php) utilizes the server variable. We can visit the page with Firefox and start injecting code. Note that some browsers, like Internet Explorer, block XSS activity.

If our anchor tag looks like

<a href="<?php print $_SERVER['PHP_SELF']; ?>?view=1">View More Info</a>

We can hack the URL by

1. Adding a forward slash ("/") to make Firefox think there's another folder
2. Typing a double quote to close the href attribute
3. Creating an onmouseover event to redirect visitors somewhere else

The new URL looks like

http://www.example.com/products.php/" onmouseover="window.location="http://www.google.com/"'

On the surface, the link shouldn't look any different. But the source code, on the other hand, shows that the onmouseover event is now part of the link (see Figure 1).

Figure 1. Source Code Showing the Event Trigger

Alternate Solution

Instead of using PHP_SELF for links, it's just as easy to use the page's file name instead. Since our script was named "products.php", the anchor tag would be changed to

<a href="products.php?view=1">View More Info</a>

Conclusion

Although PHP_SELF seems like a useful option when creating links that lead to the same page, the security risk involved with the variable isn't worth it—especially when the alternative is so simple.