How to prevent XSS with HTML/PHP?


Question

How do I prevent XSS (cross-site scripting) using just HTML and PHP?

I've seen numerous other posts on this topic but I have not found an article that clear and concisely states how to actually prevent XSS.

1
236
1/3/2010 8:09:09 PM

Basically you need to use the function htmlspecialchars() whenever you want to output something to the browser that came from the user input.

The correct way to use this function is something like this:

echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

Google Code University also has these very educational videos on Web Security:

272
5/23/2018 10:13:17 PM

Licensed under: CC-BY-SA with attribution
Not affiliated with: Stack Overflow
Icon