[ıllı LυςкY ıllı]

Have learned a good thing. Thanks for the share.

[GambleSickness]

woow very good and detailed tutorial , many have knowledge leak when it comes to these stuff ...

[Volim te]

I use htmlentities() myself but great tut anyway.

[Volim te]

Yes this exactly.

However I myself do use htmlspecialchars when saving to db for certain things, such as usernames for my website. This is fine. Otherwise, parse on output is the recommended practice.

If you allow certain tags with htmlentities(), eg <b>, ensure that you are aware of the fact that people can still execute scripts.

Eg:
<b onload='alert(1)'></b>

To the OP:
Well done and thanks for the tutorial :) This should help a lot of people secure their websites.

I mostly add a number is `disallowed` words like javascript, onload, onerror ,document.cookie etc.