Security with htmlspecialchars()

Learn to close the XSS hole from user input with htmlspecialchars().

XSS and htmlspecialchars()

Printing user data straight to the screen creates an XSS (Cross-Site Scripting) hole. If a malicious user types <script>alert('bad')</script> in a form field, it runs as is. htmlspecialchars() turns <, >, &, " and ' into HTML entities; the browser then shows them as text instead of running them as code.

Example: echo htmlspecialchars($_POST['name']);. The input <script> comes out as <script>; harmless.

The ENT_QUOTES flag

By default htmlspecialchars() turns the double quote into " but leaves the single quote alone. To convert single quotes too, pass the ENT_QUOTES flag: htmlspecialchars($text, ENT_QUOTES). Now both " and ' are safe.

This matters especially for values placed inside an attribute: value="<?php echo htmlspecialchars($name, ENT_QUOTES); ?>". Otherwise an input like ' onclick='alert(1) can break out of the attribute.

Exercise Stop XSS with htmlspecialchars

Set $_POST['comment'] = "<script>alert(1)</script>";. Then write echo htmlspecialchars($_POST['comment'], ENT_QUOTES);.

Show example solution

First set $_POST['comment'] = "<script>alert(1)</script>";. Then write echo htmlspecialchars($_POST['comment'], ENT_QUOTES);
Example solution:
<?php
// Stop XSS with htmlspecialchars
$_POST['comment'] = "<script>alert(1)</script>";
echo htmlspecialchars($_POST['comment'], ENT_QUOTES);

Test yourself

What does htmlspecialchars() do?
- It deletes form data
- It destroys HTML tags
- It validates the form
- It converts special characters to HTML entities
Show answer

It converts special characters to HTML entities — Correct. htmlspecialchars turns <, >, &, ", ' into safe HTML entities.
Match each character to its HTML entity

<

<
>

>
&

&
"

"

Escape with htmlspecialchars

echo ____($_POST['comment']);

Show answer

echo htmlspecialchars($_POST['comment']);

Next lesson: Form validation basics

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies