XSS Attack Prevention

Escape HTML entities to prevent Cross-Site Scripting attacks.

Code

General
// Escape HTML entities to prevent XSS
$safeOutput = htmlspecialchars($userInput, ENT_QUOTES | ENT_HTML5, 'UTF-8');
return $safeOutput;

Parameters

Untrusted user input (try a malicious payload)

Server

What is XSS?

Cross-Site Scripting (XSS) occurs when untrusted data is included in a web page without proper escaping. An attacker can inject malicious scripts that execute in other users' browsers.

// DANGEROUS: Directly echoing user input
"<div>Welcome, $userInput!</div>";
// If $userInput is "<script>alert('XSS')</script>", the script executes!

Why htmlspecialchars() Works

The function converts dangerous characters to HTML entities:

CharacterEscapedWhy
<&lt;Prevents opening tags
>&gt;Prevents closing tags
"&quot;Prevents breaking out of attributes
'&#039;Prevents breaking out of attributes (with ENT_QUOTES)
&&amp;Prevents entity injection

The Flags Matter

// GOOD: Escape both single and double quotes, use HTML5 entities
htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8');

// BAD: Default only escapes double quotes
htmlspecialchars($input);  // Single quotes can still break attributes!

Create a Helper Function

function e($str) {
    return htmlspecialchars($str, ENT_QUOTES | ENT_HTML5, 'UTF-8');
}

// Usage
"<div>Welcome, " . e($userInput) . "!</div>";

The Rule

Always use htmlspecialchars() with ENT_QUOTES when outputting untrusted data in HTML.


More PHP Snippets