SEC-ECHO-GET-001
echo $_GET['name']
echo $_GET / unescaped output
XSS is not a Joomla-version feature. Joomla 6 still executes it. Migrations should close it.
echo $_GET['name'] → Input + htmlspecialchars / Text
Symptoms people search
xss · echo GET
Replace this code
Swap echo $_GET['name'] for Input + htmlspecialchars / Text.
Joomla 3
Remove or stop calling this
echo $_GET['q'];Joomla 4 / 6
Use this instead
echo htmlspecialchars($app->getInput()->getString('q'), ENT_QUOTES, 'UTF-8');How to fix it
- 1Never echo superglobals.
- 2Escape at the edge.
Also known as
$_GET · $_POST · XSS
There is no 1:1 swap for this one. The architecture changed. If you cannot rewrite it, Infyways can.
Related issues
- Joomla 3 → 4PHP
jimport() autoloader calls
jimport('joomla.filesystem.file') → use Joomla\CMS\Filesystem\File;
- Joomla 3 → 4PHP
DS path constant
DS → DIRECTORY_SEPARATOR or /
- Joomla 3 → 4PHP
JPATH_PLATFORM
JPATH_PLATFORM → Do not use — autoload instead
- Joomla 3 → 4PHP
mysql_* PHP functions
mysql_query() → Joomla DatabaseInterface / mysqli / PDO
- Joomla 3 → 4PHP
each() / create_function() / ereg / split
each($array) → foreach / closures / preg_*
- Joomla 4 → 5PHP
Dynamic PHP properties (PHP 8.2+)
$this->foo = 1 on an untyped class → Declare the property or use AllowDynamicProperties