我应该使用php htmlentities（）与pdo过滤输入和输出转义？

Question

should i use php's htmentities() with pdo to filter input and output escapeing, to protect from xss attack ?

Answer 1

Use htmlentities (or preferably htmlspecialchars) when outputting user supplied content in an HTML context (i.e. when displaying it on your website). Don't HTML escape values that go into the database, since there's no XSS vulnerability there and you usually want to store the raw data in the database and escape it later as necessary.