Using a `<textarea>` to protect against scripts

Question

Hmm. Instead of "defanging" input or using some kind of regex to remove tags, how safe is it to dump user stuff into a <textarea>?

For example, say there's a PHP page that does the following:

echo '<textarea>';
echo $_GET['whuh_you_say'] ;
echo '</textarea>';

Normally this is vulnerable to xss attacks, but in the textarea, all script tags will just show up as <script> and they won't be executed.

Is this unsafe?

Answer 1

</textarea>
  <script type="text/javascript">
    alert("this safe...");
    /* load malicious c0dez! */
  </script>
<textarea>

Answer 2

strip_tags(string);

Is wonderful! Honest!

Answer 3

Good enough for the basics:

sanitized = str_replace("<", "&lt;", $_GET['whuh_you_say']);
sanitized = str_replace(">", "&gt;", sanitized);

Answer 4

If your users aren't supposed to be using any HTML tags whatsoever (which if you're proposing this textarea solution, that's the case), just run it through htmlspecialchars() or htmlentities() and be done with it. Guaranteed safety.

Answer 5

This talks about an XSS hole found in textarea's in google documents (I think the post is a little old - so google have probably secured it by now), but it deomstrates how textareas can be used as an attack vector.

ha.ckers.org discussing google docs textarea exploit