Is htmlspecialchars sufficient against low level XSS in my case?

Question

I have added functionality to my admin so it preserves the URL which you tried to access before it asked you to login. So, if you go to:

/admin/foo/bar?baz

It'll redirect you to:

/admin/auth/login

After you login, before my function add-on you always went to /admin/user/profile. Right now, I save /admin/foo/bar?baz in a session variable, $_SESSION['from'].

In the login <form>, the hidden value takes the value of the session:

<input type="hidden" name="from" value="<?php echo htmlspecialchars($_SESSION['from'];)?>">

Then, after the form is submitted a redirect takes place:

header('Location: ' . $_POST['from'] );

I have seen other questions relating to XSS and htmlspecialchars and am aware it won't fix all possible XSS attempts, but would this work successfully against "low level" XSS attempts?

Answer 1

While there's no XSS attack here, if you're using a slightly older version of PHP, you'll open yourself up to HTTP header injection, which can be worse in some cases.

If you're fetching the URL-to-be-returned-to from the HTTP referrer, then you should be protected well enough by making sure the URL is one that you control by parsing it, then only storing the return path and query string. When performing the final redirect, you should make sure that the components of the path are properly URL encoded. You can store the return URL entirely in the session instead of punting it back out to the user to possibly manipulate during the login.