InfinityQuest - Programming Code Tutorials and Examples with Python, C++, Java, PHP, C#, JavaScript, Swift and more

Menu
  • Home
  • Sitemap

Python Programming Language Best Tutorials and Code Examples

Learn Python Right Now!
Home
PHP
Preventing Cross-Site Scripting in PHP
PHP

Preventing Cross-Site Scripting in PHP

InfinityCoder November 28, 2016

You want to securely display user-entered data on an HTML page. For example, you want to allow users to add comments to a blog post without worrying that HTML or JavaScript in a comment will cause problems.

Pass user input through htmlentities() before displaying it, as in Example 9-18.
Example 9-18. Escaping HTML

1
2
print 'The comment was: ';
print htmlentities($_POST['comment']);

PHP has a pair of functions to escape HTML entities. The most basic is htmlspecial chars(), which escapes four characters: < > ” and &. Depending on optional parameters, it can also translate ‘ instead of or in addition to “.

For more complex encoding, use htmlentities(); it expands on htmlspecialchars() to encode any character that has an HTML entity.

Example 9-19 shows htmlspecialchars() in action.

Example 9-19. Escaping HTML entities

1
2
3
4
$html = "<a href='fletch.html'>Stew's favorite movie.</a>\n";
print htmlspecialchars($html); // double-quotes
print htmlspecialchars($html, ENT_QUOTES); // single- and double-quotes
print htmlspecialchars($html, ENT_NOQUOTES); // neither

Example 9-19 prints:

1
2
3
<a href='fletch.html'>Stew's favorite movie.</a>
<a href='fletch.html'>Stew's favorite movie.</a>
<a href='fletch.html'>Stew's favorite movie.</a>

By default, both htmlentities() and htmlspecialchars() use the UTF-8 character set (as of PHP 5.4.0. Before that, the default was ISO-8859-1).

To use a different character set, pass the character set as a third argument. For example, to use BIG5, call htmlenti
ties($string, ENT_QUOTES, “BIG5”).

 

 

Share
Tweet
Email
Prev Article
Next Article

Related Articles

Matching Words in PHP
You want to pull out all words from a string. …

Matching Words in PHP

Sorting in a Locale-Aware Order in PHP
You need to sort text in a way that respects …

Sorting in a Locale-Aware Order in PHP

About The Author

InfinityCoder
InfinityCoder

Leave a Reply

Cancel reply

Recent Tutorials InfinityQuest

  • Adding New Features to bash Using Loadable Built-ins in bash
    Adding New Features to bash Using Loadable …
    June 27, 2017 0
  • Getting to the Bottom of Things in bash
    Getting to the Bottom of Things in …
    June 27, 2017 0

Recent Comments

    Categories

    • Bash
    • PHP
    • Python
    • Uncategorized

    InfinityQuest - Programming Code Tutorials and Examples with Python, C++, Java, PHP, C#, JavaScript, Swift and more

    About Us

    Start learning your desired programming language with InfinityQuest.com.

    On our website you can access any tutorial that you want with video and code examples.

    We are very happy and honored that InfinityQuest.com has been listed as a recommended learning website for students.

    Popular Tags

    binary data python CIDR convert string into datetime python create xml from dict python dictionary into xml python how to create xml with dict in Python how to write binary data in Python IP Address read binary data python tutorial string as date object python string to datetime python

    Archives

    • June 2017
    • April 2017
    • February 2017
    • January 2017
    • December 2016
    • November 2016
    Copyright © 2019 InfinityQuest - Programming Code Tutorials and Examples with Python, C++, Java, PHP, C#, JavaScript, Swift and more
    Programming Tutorials | Sitemap