Prevent scripts from executing by encoding untrusted data for its precise HTML output context. The examples separate the essential operation from the conditions a production implementation must enforce.
What It Does
Prevent scripts from executing by encoding untrusted data for its precise HTML output context.
Prerequisites
Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.
Example 1: Core Behavior
The first example isolates the core operation so its result is easy to understand.
<?php
$name = '<img src=x onerror=alert(1)>';
echo '<p>' . htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '</p>';Example 2: Alternative or Failure Case
The second example demonstrates an alternative outcome, rule or failure condition.
<?php
$value = '" onclick="alert(1)';
echo '<input value="' . htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '">';Practical Example: Applying the Rule
The practical example shows how to carry the same constraint into application code.
<?php
$payload = ['message' => '</script><script>alert(1)</script>'];
header('Content-Type: application/json; charset=utf-8');
echo json_encode($payload, JSON_THROW_ON_ERROR);Important Behavior and Edge Cases
HTML escaping is not sufficient in JavaScript, CSS, arbitrary URLs or HTML event handlers.
Comparison with Related Functions or Patterns
| Approach | When it differs |
|---|---|
| Understanding Cross-Site Scripting (XSS) in PHP | Prevent scripts from executing by encoding untrusted data for its precise HTML output context. |
| Related API or pattern | Input validation constrains data while output encoding prevents browser interpretation. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Putting raw user text directly inside HTML markup or attributes | HTML escaping is not sufficient in JavaScript, CSS, arbitrary URLs or HTML event handlers. |
| Substituting a related API without checking its semantics | Input validation constrains data while output encoding prevents browser interpretation. |
Key Takeaways
- Prevent scripts from executing by encoding untrusted data for its precise HTML output context.
- HTML escaping is not sufficient in JavaScript, CSS, arbitrary URLs or HTML event handlers.
- Input validation constrains data while output encoding prevents browser interpretation.
Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.