Rules / PHP
SHIELD-PHP-008
Reflected XSS via echo of request data
What it detects
Request superglobal is echoed or printed without output encoding, enabling cross-site scripting.
How to fix
Encode output with htmlspecialchars() using ENT_QUOTES before echoing user input.
Vulnerable — Shield flags thissearch.php
<?php
// Search results page — vulnerable to reflected XSS
echo '<h2>Results for: ' . $_GET['q'] . '</h2>';
echo '<p>No products matched your search.</p>';
Fixed — scans cleansearch.php
<?php
// Encode user input with htmlspecialchars before it reaches the page
$query = htmlspecialchars($_GET['q'] ?? '', ENT_QUOTES, 'UTF-8');
echo '<h2>Results for: ' . $query . '</h2>';
echo '<p>No products matched your search.</p>';
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-008, the fixed one does not.