htmlspecialchars is a PHP function that convert special characters to HTML entities.
htmlspecialchars is a PHP function that convert special characters to HTML entities.
Famous question: htmlentities() vs. htmlspecialchars()
Questions tagged [htmlspecialchars]
467 questions
2
votes
2 answers
2
votes
3 answers
How to display htmlspecialchars on the html?
I've read here:
https://stackoverflow.com/a/8932454/4301970
that htmlspecialchars() is very effective preventing xss attacks.
I'm receiving formated text from a wysiwyg editor, for example:
random425
2
votes
1 answer
What am I missing? SQL injection
I'm trying to filter out as much as possible to prevent nasty SQL injection, here's my code example, is there anything I'm missing?
$name = htmlspecialchars($row['name']);
echo '
'.$name.'
';
in my html code ^
if(…
DagicCross
- 401
- 3
- 13
2
votes
3 answers
How to secure a form?
I was reading an article about form security because I have a form in which a user can add messages.
I read that it was best to use strip_tags(), htmlspecialchars() and nl2br(). Somewhere else it is being said to use html_entity_decode().
I have…
AdRock
- 2,959
- 10
- 66
- 106
2
votes
1 answer
Htmlspecialchars does not work with variable passed
I'm using htmlspecialchars to display Greek letters correctly in my html. For that reason I have:
$array = array('sampleGreekString' => 'Ενδιαφερόμαστε για το φορτίο σας')
When I call the function like this:
htmlspecialchars('Ενδιαφερόμαστε για το…
Isadora
- 423
- 1
- 5
- 12
2
votes
2 answers
use of htmlspecialchars()
I am learning php and I came across htmlspecialchars() that it is used to prevent hackers attack , How ? I have read it on google , did not understand yet.Can you please give an example how ?
2
votes
2 answers
PHP: htmlspecialchars, but keep HTML entities
I've been working on a small side project which formats Skype logs to make them look nice. This is going great, but I have hit a somewhat annoying bump in the road.
Here is a great (and somewhat obscene) example of what is going on. As you can see,…
mattrick
- 3,580
- 6
- 27
- 43
2
votes
1 answer
file_get_contents fail when a url have &
I have a problem i am trying to use
file_get_contents('');
to request the contents of a url but php keeps adding
amp;
to every part of the url that has an & symbol te url I am trying to request is like the one bellow
…
saveonsky
- 51
- 3
2
votes
4 answers
output data from database using htmlspecialchars() that has been filtered using filter_input()
I have found from different blogs that it is strongly recommended to use htmlspecialchars() to output any data on screen to be safe from XSS Attack.
I am using filter_input() to filter any data that comes from user before inserting into database.…
Coder
- 237
- 4
- 21
2
votes
1 answer
Why doesn't htmlspecialchars convert quotes inside an input value?
I have the following code:
where $row['nr_p_vac'] is test ' " / /n /t <>.
When I'm not using htmlspecialchars in the input there's only test ' (of…
Hello Lili
- 1,527
- 1
- 25
- 50
2
votes
1 answer
how can set substr for special chars?
how can I substr a text that execute htmlspecialchars to it.
saved in database
some text " some text " some text
' some text ' some text 'some text' some text '
some text 'some text ' some text '…
Simon
- 147
- 2
- 10
2
votes
2 answers
htmlspecialchars(); don't work
When I use "htmlspecialchars" in this code:
w3s.com");
echo $test;
?>
I want see HTML entites, such as:
"><script>alert - for example.
But I see this:
w3s.com
And in browser HTML markup…
hidd
- 336
- 3
- 11
2
votes
1 answer
htmlentities not working on single quote
I am trying to do a simple convert of single quote (') to html entity (') but can not figure out why this is not working.
$test = "Bob's House";
echo htmlentities($test,ENT_QUOTES);
echo htmlspecialchars($test,ENT_QUOTES);
Both examples still…
Stephen Croft
- 801
- 1
- 8
- 12
2
votes
2 answers
Apostrophe cause problems inserting query when using trim, stripslashes and htmlspecialchars
When I use text with an apostrophe, the query don't work.
Example: This is Ben's party.
This is the function I use:
function text_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
…
user3328041
2
votes
1 answer
Why does htmlspecialchars work on 'PHP_SELF' and not on 'REQUEST_URI' on form post?
I write
http://www.mysite.com/form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E
on URL. Now I press enter and the URL is:
http://www.mysite.com/form.php/">
Now I post the form. When using $_SERVER['PHP_SELF'],…
Perocat
- 1,481
- 7
- 25
- 48