{"id":1524,"date":"2021-05-08T02:36:22","date_gmt":"2021-05-08T02:36:22","guid":{"rendered":"https:\/\/phptutorial.net\/?page_id=1524"},"modified":"2025-04-07T12:49:27","modified_gmt":"2025-04-07T12:49:27","slug":"php-htmlspecialchars","status":"publish","type":"page","link":"https:\/\/www.phptutorial.net\/php-tutorial\/php-htmlspecialchars\/","title":{"rendered":"PHP htmlspecialchars Function"},"content":{"rendered":"\n

Summary<\/strong>: in this tutorial, you’ll learn how to use the PHP htmlspecialchars()<\/code> function to prevent XSS attacks.<\/p>\n\n\n\n

What Is XSS? #<\/a><\/h2>\n\n\n\n

XSS stands for cross-site scripting. It’s a kind of attack where a hacker injects malicious client code into a web page’s output.<\/p>\n\n\n\n

For example, if you have a form that allows users to submit comments and display them on the page. If you display the comments without any processing, your page is vulnerable to the XSS attack.<\/p>\n\n\n\n

A hacker may submit a comment with JavaScript code that redirects<\/a> users to a malicious website. For example:<\/p>\n\n\n

<script>location.replace('<malicious website url>'<\/span>);<\/script><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
This comment contains a JavaScript code that redirects the users to a malicious website.<\/p>\n\n\n\n
To prevent XSS attacks, you should always escape the string from unknown sources such as user inputs. To escape a string for output, you use the htmlspecialchars()<\/code> function.<\/p>\n\n\n\n
Introduction to the PHP htmlspecialchars() function #<\/a><\/h2>\n\n\n\n
The htmlspecialchars()<\/code> function accepts an input string ($string<\/code>) and returns the new string with the special characters converted into HTML entities.<\/p>\n\n\n
htmlspecialchars ( \n    string $string , \n    int $flags = ENT_COMPAT , \n    string|null<\/span> $encoding = null<\/span> , \n    bool $double_encode = true<\/span> \n) : string<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
The function accepts four parameters:<\/p>\n\n\n\n
If you store this comment in the database<\/a> and display it in the comments section. When legitimate users visit the page, the JavaScript code will execute and redirect the users to the malicious website.<\/p>\n\n\n\n