---
id: php-form-validation
title: "PHP Form Validation"
category: "Programming_Language"
status: "draft"
verification_status: "conceptual"
canonical_id: ""
aliases: ["PHP_SELF exploit", "XSS", "PHP 폼 검증"]
duplicate_of: ""
source_trust_level: "B"
confidence_score: 0.9
created_at: 2026-07-04
updated_at: 2026-07-04
review_reason: ""
merge_history: []
tags: ["php", "programming", "w3schools", "forms", "security", "xss"]
raw_sources: ["https://www.w3schools.com/php/php_form_validation.asp"]
applied_in: []
github_commit: ""
---

# [[PHP Form Validation]]

## 🎯 한 줄 통찰 (One-line insight)
`$_SERVER["PHP_SELF"]` used raw in a form's `action` attribute is a genuine XSS vulnerability — a crafted URL like `test_form.php/"><script>alert('hacked')</script>` gets echoed verbatim into the HTML, injecting a live script tag; wrapping it in `htmlspecialchars()` converts the dangerous characters to harmless HTML entities, neutralizing the exploit. [S1]

## 🧠 핵심 개념 (Core concepts)
- **`$_SERVER["PHP_SELF"]`** — returns the current script's filename; often used as a self-submitting form's `action`. [S1]
- **PHP_SELF XSS vulnerability** — appending a crafted path suffix to the URL lets an attacker inject a `<script>` tag into the raw output. [S1]
- **`htmlspecialchars()`** — the fix: converts `<`, `>`, `"` etc. into HTML entities, neutralizing injected markup. [S1]
- **`trim()`** — strips extraneous whitespace/tabs/newlines from user input. [S1]
- **`stripslashes()`** — removes backslashes from user input. [S1]
- **`test_input()`** — a custom reusable function combining trim + stripslashes + htmlspecialchars, applied to every `$_POST` field. [S1]
- **`$_SERVER["REQUEST_METHOD"] == "POST"`** — gate that skips validation when the form hasn't been submitted yet. [S1]

## 📖 세부 내용 (Details)
- Exploit demonstration: raw `$_SERVER["PHP_SELF"]` in a form action, combined with a URL like `.../test_form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E`, results in an executable injected script. [S1]
- Fix: `<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">`. [S1]
- Sanitizing function: `function test_input($data) { $data = trim($data); $data = stripslashes($data); $data = htmlspecialchars($data); return $data; }`. [S1]
- Full validation gate: `if ($_SERVER["REQUEST_METHOD"] == "POST") { $name = test_input($_POST["name"]); ... }`. [S1]

## ⚖️ 모순 및 업데이트 (Contradictions & updates)
- **PHP_SELF의 실질적 보안 취약점**: htmlspecialchars() 없이 사용하면 XSS 공격에 노출된다는 점이 구체적인 공격 예제로 직접 증명됨. [S1]

## 🛠️ 적용 사례 (Applied in summary)
현재 발견된 실제 적용 사례가 없습니다 — test_input() 함수로 모든 $_POST 필드를 일괄 정제하는 패턴이 실전 폼 검증의 표준이다. [S1]

## 💻 코드 패턴 (Code patterns)
Reusable input sanitization function (PHP):
```php
function test_input($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
```

## ✅ 검증 상태 및 신뢰도
- **상태:** draft
- **검증 단계:** conceptual
- **출처 신뢰도:** B (W3Schools — widely used educational reference, not a primary standards body)
- **신뢰 점수:** 0.90
- **중복 검사 결과:** 신규 생성 (New discovery)

## 🔗 지식 그래프 (Knowledge Graph)
- **상위/루트:** [[PHP Tutorial]]
- **관련 개념:** [[PHP Forms]], [[PHP Form Required]], [[PHP Superglobals Server]]
- **참조 맥락:** 보안을 고려한 폼 처리 — 필수 필드 검증(Required) 챕터로 이어짐.

## 📚 출처 (Sources)
- [S1] W3Schools — PHP Form Validation — https://www.w3schools.com/php/php_form_validation.asp

## 📝 변경 이력 (Change history)
- 2026-07-04: Initial draft synthesized from the W3Schools "PHP Form Validation" page (Astra wiki-curation, P-Reinforce v3.1 format).