I have a strange problem when i visit some page like this

example.com/node/386 "onmouseover=prompt(9999) "

from Drupal perspective that page doesn't exists right ?

getting something like this

enter image description here

  • The second portion of the url is parsed as Javascript in your example. I could however not reproduce this on any other Drupal site. So I guess it is not Drupal related, but a browser or module setting somehow. Jun 27 '15 at 16:37
  • @Neograph734, yes it is not happening on my other sites as well, can you guess the reason?
    – niksmac
    Jun 29 '15 at 4:20
  • Could be anything, browser, server, module... If you have the same browser and server, you could try by disabling modules one by one. But I don't know if you will find it then... Jun 29 '15 at 10:19

I was alterting the body class array for some reason with a non safe code.

$variables['classes_array'][] = 'mysite-'.arg(0);

Now, changed to

$variables['classes_array'][] = 'mysite-'.check_plain(arg(0));

As you can see javascript gets executed as added it to dom body


Encodes special characters in a plain-text string for display as HTML.

PHP strip_tags will work too.

(PHP 4, PHP 5) strip_tags — Strip HTML and PHP tags from a string

Hope someone finds it helpful.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.