If using chrome to test this you might be lured into a false sense of security as chrome has XSS protection built in, you should add this PHP header to your site to be able to test in chrome: header("X-XSS-Protection: 0");