docs(10_Wiki): 위키 구조 정리 — 언어 튜토리얼 카테고리 폴더 제거 + 신규 자산 동기화

Topic_CSS/Topic_HTML/Topic_JavaScript/Topic_Prompt/Topic_Comfyui 등 기존 카테고리 폴더를 정리하고,
Topic_Graphic/Dev 등 신규 산출물과 Topics 내부 세션/메모리 기록을 동기화.

10_Wiki/Dev/Topic_PHP/PHP_Form_Validation.md

@@ -0,0 +1,75 @@
+---
+id: php-form-validation
+title: "PHP Form Validation"
+category: "Programming_Language"
+status: "draft"
+verification_status: "conceptual"
+canonical_id: ""
+aliases: ["PHP_SELF exploit", "XSS", "PHP 폼 검증"]
+duplicate_of: ""
+source_trust_level: "B"
+confidence_score: 0.9
+created_at: 2026-07-04
+updated_at: 2026-07-04
+review_reason: ""
+merge_history: []
+tags: ["php", "programming", "w3schools", "forms", "security", "xss"]
+raw_sources: ["https://www.w3schools.com/php/php_form_validation.asp"]
+applied_in: []
+github_commit: ""
+---
+
+# [[PHP Form Validation]]
+
+## 🎯 한 줄 통찰 (One-line insight)
+`$_SERVER["PHP_SELF"]` used raw in a form's `action` attribute is a genuine XSS vulnerability — a crafted URL like `test_form.php/"><script>alert('hacked')</script>` gets echoed verbatim into the HTML, injecting a live script tag; wrapping it in `htmlspecialchars()` converts the dangerous characters to harmless HTML entities, neutralizing the exploit. [S1]
+
+## 🧠 핵심 개념 (Core concepts)
+- **`$_SERVER["PHP_SELF"]`** — returns the current script's filename; often used as a self-submitting form's `action`. [S1]
+- **PHP_SELF XSS vulnerability** — appending a crafted path suffix to the URL lets an attacker inject a `<script>` tag into the raw output. [S1]
+- **`htmlspecialchars()`** — the fix: converts `<`, `>`, `"` etc. into HTML entities, neutralizing injected markup. [S1]
+- **`trim()`** — strips extraneous whitespace/tabs/newlines from user input. [S1]
+- **`stripslashes()`** — removes backslashes from user input. [S1]
+- **`test_input()`** — a custom reusable function combining trim + stripslashes + htmlspecialchars, applied to every `$_POST` field. [S1]
+- **`$_SERVER["REQUEST_METHOD"] == "POST"`** — gate that skips validation when the form hasn't been submitted yet. [S1]
+
+## 📖 세부 내용 (Details)
+- Exploit demonstration: raw `$_SERVER["PHP_SELF"]` in a form action, combined with a URL like `.../test_form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E`, results in an executable injected script. [S1]
+- Fix: `<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">`. [S1]
+- Sanitizing function: `function test_input($data) { $data = trim($data); $data = stripslashes($data); $data = htmlspecialchars($data); return $data; }`. [S1]
+- Full validation gate: `if ($_SERVER["REQUEST_METHOD"] == "POST") { $name = test_input($_POST["name"]); ... }`. [S1]
+
+## ⚖️ 모순 및 업데이트 (Contradictions & updates)
+- **PHP_SELF의 실질적 보안 취약점**: htmlspecialchars() 없이 사용하면 XSS 공격에 노출된다는 점이 구체적인 공격 예제로 직접 증명됨. [S1]
+
+## 🛠️ 적용 사례 (Applied in summary)
+현재 발견된 실제 적용 사례가 없습니다 — test_input() 함수로 모든 $_POST 필드를 일괄 정제하는 패턴이 실전 폼 검증의 표준이다. [S1]
+
+## 💻 코드 패턴 (Code patterns)
+Reusable input sanitization function (PHP):
+```php
+function test_input($data) {
+    $data = trim($data);
+    $data = stripslashes($data);
+    $data = htmlspecialchars($data);
+    return $data;
+}
+```
+
+## ✅ 검증 상태 및 신뢰도
+- **상태:** draft
+- **검증 단계:** conceptual
+- **출처 신뢰도:** B (W3Schools — widely used educational reference, not a primary standards body)
+- **신뢰 점수:** 0.90
+- **중복 검사 결과:** 신규 생성 (New discovery)
+
+## 🔗 지식 그래프 (Knowledge Graph)
+- **상위/루트:** [[PHP Tutorial]]
+- **관련 개념:** [[PHP Forms]], [[PHP Form Required]], [[PHP Superglobals Server]]
+- **참조 맥락:** 보안을 고려한 폼 처리 — 필수 필드 검증(Required) 챕터로 이어짐.
+
+## 📚 출처 (Sources)
+- [S1] W3Schools — PHP Form Validation — https://www.w3schools.com/php/php_form_validation.asp
+
+## 📝 변경 이력 (Change history)
+- 2026-07-04: Initial draft synthesized from the W3Schools "PHP Form Validation" page (Astra wiki-curation, P-Reinforce v3.1 format).