title: Is the meta tag content value from an xpath query trustable?
body: <p>I have a php function who extracts meta tags from an url with xpath queries.</p>
  
  <p>e.g <code>$xpath-&gt;query('/html/head/meta[@name="my_target"]/@content')</code></p>
  
  <p>My question : </p>
  
  <p>Can I trust the returned value or should I verify it ?</p>
  
  <p>=> Is there any possible XSS exploit ?</p>
  
  <p>=> Should the html content be purified before loading it in the <code>DOMDocument</code> ?</p>
  
  <pre><code> // Other way to say it with some code :
  
      $doc = new DOMDocument;
      $doc-&gt;preserveWhiteSpace = false;
      libxml_use_internal_errors(true);
  
      // is
      $doc-&gt;loadHTMLFile($url);
      // trustable ??
  
      // or is
      file_get_contents($url);
      $trust = $purifier-&gt;purify($html);
      $doc-&gt;loadHTML($trust);
      // a better practice ??
  
      libxml_use_internal_errors(false);
      $xpath = new DOMXPath($doc);
  
      $trustable = $xpath-&gt;query('/html/head/meta[@name="my_target"]/@content')-&gt;item(0) // ?
  </code></pre>
  
  <p>===== UPDATE =========================================</p>
  
  <p>Yes, never trust external sources.</p>
  
  <p>use <code>$be_sure = htmlspecialchars($trustable-&gt;textContent)</code> or <code>strip_tags($trustable-&gt;textContent)</code></p>