在回显变量时防止XSS攻击

Question

I need to prevent from XSS attacks when I echoing variables in PHP.

For example, just assume I have two values from my database, one for username and the other one is email address.

$username
$email

So now I want to prevent from XSS attack when I using these variables in my HTML.

I tried it something like this using htmlspecialchars() -

<h5>Editing User <?php echo '"<strong>'.htmlspecialchars($username, ENT_QUOTES, 'UTF-8').'"</strong> (<strong>'; echo htmlspecialchars($email, ENT_QUOTES, 'UTF-8').'</strong>)'; ?></h5>

This is rendered HTML from above PHP

<h5>Editing User <strong>test_user</strong> (<strong>[e-mail]</strong>)</h5>

So, can somebody tell me is this the correct way do I need to go? If not so what is the correct way?

Hope somebody may help me out. Thank you.

Answer 1

First of all, the correct way to escape output is htmlentities, not htmlspecialchars.
Escape ALL output you get from variables, database or user input.
This is pretty much all you have to do to escape XSS attacks.
You may also consider using strip_tags where it's appropriate.

Here you go:

<h5>
    Editing User <b><?=htmlentities($username)?></b> 
    (<b><?=htmlentities($email)?></b>)
</h5>