From 3b51f6bb5a728ec0c447f76bf53782751a85c43f Mon Sep 17 00:00:00 2001
From: g0w6y <g0w6y@users.noreply.github.com>
Date: Sun, 5 Apr 2026 21:29:07 +0530
Subject: [PATCH] fix(examples): prevent reflected XSS by encoding var_export()
 output

---
 examples/recaptcha-request-curl.php         | 6 +++---
 examples/recaptcha-request-post.php         | 6 +++---
 examples/recaptcha-request-socket.php       | 6 +++---
 examples/recaptcha-v2-checkbox-explicit.php | 6 +++---
 examples/recaptcha-v2-checkbox.php          | 6 +++---
 examples/recaptcha-v2-invisible.php         | 6 +++---
 6 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/examples/recaptcha-request-curl.php b/examples/recaptcha-request-curl.php
index 2c81d05..5fe0629 100644
--- a/examples/recaptcha-request-curl.php
+++ b/examples/recaptcha-request-curl.php
@@ -87,7 +87,7 @@
     // In production, *always* sanitise and validate your input'
     ?>
         <h2><kbd>POST</kbd> data</h2>
-        <kbd><pre><?php var_export($_POST); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($_POST, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <?php
     // If the form submission includes the "g-captcha-response" field
     // Create an instance of the service using your secret and the CurlPost request method.
@@ -111,7 +111,7 @@
         // If the response is a success, that's it!
         ?>
         <h2>Success!</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>That's it. Everything is working. Go integrate this into your real project.</p>
         <p><a href="/recaptcha-request-curl.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
         <?php
@@ -119,7 +119,7 @@
         // If it's not successful, then one or more error codes will be returned.
         ?>
         <h2>Something went wrong</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>Check the error code reference at <kbd><a href="https://developers.google.com/recaptcha/docs/verify#error-code-reference">https://developers.google.com/recaptcha/docs/verify#error-code-reference</a></kbd>.
         <p><strong>Note:</strong> Error code <kbd>missing-input-response</kbd> may mean the user just didn't complete the reCAPTCHA.</p>
         <p><a href="/recaptcha-request-curl.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
diff --git a/examples/recaptcha-request-post.php b/examples/recaptcha-request-post.php
index 24b109e..e223a8b 100644
--- a/examples/recaptcha-request-post.php
+++ b/examples/recaptcha-request-post.php
@@ -86,7 +86,7 @@
     // In production, *always* sanitise and validate your input'
     ?>
         <h2><kbd>POST</kbd> data</h2>
-        <kbd><pre><?php var_export($_POST); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($_POST, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <?php
     // If the form submission includes the "g-captcha-response" field
     // Create an instance of the service using your secret and the Post request method.
@@ -110,7 +110,7 @@
         // If the response is a success, that's it!
         ?>
         <h2>Success!</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>That's it. Everything is working. Go integrate this into your real project.</p>
         <p><a href="/recaptcha-request-post.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
         <?php
@@ -118,7 +118,7 @@
         // If it's not successful, then one or more error codes will be returned.
         ?>
         <h2>Something went wrong</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>Check the error code reference at <kbd><a href="https://developers.google.com/recaptcha/docs/verify#error-code-reference">https://developers.google.com/recaptcha/docs/verify#error-code-reference</a></kbd>.
         <p><strong>Note:</strong> Error code <kbd>missing-input-response</kbd> may mean the user just didn't complete the reCAPTCHA.</p>
         <p><a href="/recaptcha-request-post.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
diff --git a/examples/recaptcha-request-socket.php b/examples/recaptcha-request-socket.php
index 949b7bf..f9b4dc2 100644
--- a/examples/recaptcha-request-socket.php
+++ b/examples/recaptcha-request-socket.php
@@ -85,7 +85,7 @@
     // In production, *always* sanitise and validate your input'
     ?>
         <h2><kbd>POST</kbd> data</h2>
-        <kbd><pre><?php var_export($_POST); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($_POST, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <?php
     // If the form submission includes the "g-captcha-response" field
     // Create an instance of the service using your secret and the SocketPost request method.
@@ -109,7 +109,7 @@
         // If the response is a success, that's it!
         ?>
         <h2>Success!</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>That's it. Everything is working. Go integrate this into your real project.</p>
         <p><a href="/recaptcha-request-socket.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
         <?php
@@ -117,7 +117,7 @@
         // If it's not successful, then one or more error codes will be returned.
         ?>
         <h2>Something went wrong</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>Check the error code reference at <kbd><a href="https://developers.google.com/recaptcha/docs/verify#error-code-reference">https://developers.google.com/recaptcha/docs/verify#error-code-reference</a></kbd>.
         <p><strong>Note:</strong> Error code <kbd>missing-input-response</kbd> may mean the user just didn't complete the reCAPTCHA.</p>
         <p><a href="/recaptcha-request-socket.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
diff --git a/examples/recaptcha-v2-checkbox-explicit.php b/examples/recaptcha-v2-checkbox-explicit.php
index 2b6fb4e..3079521 100644
--- a/examples/recaptcha-v2-checkbox-explicit.php
+++ b/examples/recaptcha-v2-checkbox-explicit.php
@@ -84,7 +84,7 @@
     // In production, *always* sanitise and validate your input'
     ?>
         <h2><kbd>POST</kbd> data</h2>
-        <kbd><pre><?php var_export($_POST); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($_POST, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <?php
     // If the form submission includes the "g-captcha-response" field
     // Create an instance of the service using your secret
@@ -113,7 +113,7 @@
         // If the response is a success, that's it!
         ?>
         <h2>Success!</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>That's it. Everything is working. Go integrate this into your real project.</p>
         <p><a href="/recaptcha-v2-checkbox-explicit.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
         <?php
@@ -121,7 +121,7 @@
         // If it's not successful, then one or more error codes will be returned.
         ?>
         <h2>Something went wrong</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>Check the error code reference at <kbd><a href="https://developers.google.com/recaptcha/docs/verify#error-code-reference">https://developers.google.com/recaptcha/docs/verify#error-code-reference</a></kbd>.
         <p><strong>Note:</strong> Error code <kbd>missing-input-response</kbd> may mean the user just didn't complete the reCAPTCHA.</p>
         <p><a href="/recaptcha-v2-checkbox-explicit.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
diff --git a/examples/recaptcha-v2-checkbox.php b/examples/recaptcha-v2-checkbox.php
index d0a4846..124f59b 100644
--- a/examples/recaptcha-v2-checkbox.php
+++ b/examples/recaptcha-v2-checkbox.php
@@ -84,7 +84,7 @@
     // In production, *always* sanitise and validate your input'
     ?>
         <h2><kbd>POST</kbd> data</h2>
-        <kbd><pre><?php var_export($_POST); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($_POST, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <?php
     // If the form submission includes the "g-captcha-response" field
     // Create an instance of the service using your secret
@@ -113,7 +113,7 @@
         // If the response is a success, that's it!
         ?>
         <h2>Success!</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>That's it. Everything is working. Go integrate this into your real project.</p>
         <p><a href="/recaptcha-v2-checkbox.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
         <?php
@@ -121,7 +121,7 @@
         // If it's not successful, then one or more error codes will be returned.
         ?>
         <h2>Something went wrong</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>Check the error code reference at <kbd><a href="https://developers.google.com/recaptcha/docs/verify#error-code-reference">https://developers.google.com/recaptcha/docs/verify#error-code-reference</a></kbd>.
         <p><strong>Note:</strong> Error code <kbd>missing-input-response</kbd> may mean the user just didn't complete the reCAPTCHA.</p>
         <p><a href="/recaptcha-v2-checkbox.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
diff --git a/examples/recaptcha-v2-invisible.php b/examples/recaptcha-v2-invisible.php
index b7e174b..4c6347d 100644
--- a/examples/recaptcha-v2-invisible.php
+++ b/examples/recaptcha-v2-invisible.php
@@ -84,7 +84,7 @@
     // In production, *always* sanitise and validate your input'
     ?>
         <h2><kbd>POST</kbd> data</h2>
-        <kbd><pre><?php var_export($_POST); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($_POST, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <?php
     // If the form submission includes the "g-captcha-response" field
     // Create an instance of the service using your secret
@@ -113,7 +113,7 @@
         // If the response is a success, that's it!
         ?>
         <h2>Success!</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>That's it. Everything is working. Go integrate this into your real project.</p>
         <p><a href="/recaptcha-v2-invisible.php"><span aria-hidden="true">⤴️</span> Try again</a></p>
         <?php
@@ -121,7 +121,7 @@
         // If it's not successful, then one or more error codes will be returned.
         ?>
         <h2>Something went wrong</h2>
-        <kbd><pre><?php var_export($resp); ?></pre></kbd>
+        <kbd><pre><?php echo htmlspecialchars(print_r($resp, true), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?></pre></kbd>
         <p>Check the error code reference at <kbd><a href="https://developers.google.com/recaptcha/docs/verify#error-code-reference">https://developers.google.com/recaptcha/docs/verify#error-code-reference</a></kbd>.
         <p><strong>Note:</strong> Error code <kbd>missing-input-response</kbd> may mean the user just didn't complete the reCAPTCHA.</p>
         <p><a href="/recaptcha-v2-invisible.php"><span aria-hidden="true">⤴️</span> Try again</a></p>