[~[DogiD]~]

Here is my tutorial how to setup htmlspecialchars() and protect your site to xss vulnerability.
If you didn't know what XSS vulnerability is then i recommend you read this tutorial first, https://hackforums.net/showthread.php?tid=2910051

What you need, before you start read tutorial?

• Website or other think to run php files (ex. XAMPP)
  


• Notepad++ or other program to edit php files.
  

Steps,

1. First make 2 php file, "index.php" and "without.php".
   Open "index.php" and build simple form page. Like this,
   Spoiler (Click to View)
   


2. When "index.php" is ready, open "without.php" file and make it looks like this,
   Spoiler (Click to View)
   
   Code

   <?php echo 'You type: ' . $_POST["without"]; ?>
   
   


3. Now when you type something in "index.php" its send it to "without.php" page. So if i type in textbox script,
   
   Code

   <script>alert(1)</script>
   
   Then i press send..
   Spoiler (Click to View)
   
   


4. Now we just need add htmlspecialchars() function in "without.php" file,
   Spoiler (Click to View)
   
   Code

   echo 'You type: ' . htmlspecialchars( $_POST["without"] );
   
   
   


5. Lets try again, what happen if i try send same script,
   Spoiler (Click to View)
   
   


6. Now htmlspecialchars() function change all <, > etc to html code and xss vulnerability is fixed.
   Congratulations! 🎉
   

Hope this tutorial help you understand how to use htmlspecialchars() function,
Good luck and have fun!

~ DogiD🤝

[LevelUp]

Very nice tutorial, well explained mate.

[redpois0n]

thank you for this! Well explained and confirmed what I knew :)

Using this for my site

[~[DogiD]~]

thank you for this! Well explained and confirmed what I knew :)

Using this for my site

Good to hear ;)
Thank you,

~ DogiD🤝

[ıllı LυςкY ıllı]

Have learned a good thing. Thanks for the share.

[what else?]

You forgot to mention htmlspecialchars is only used while parsing the content.
Do not use htmlspecialchars then save a content to a db then parse it.

[GambleSickness]

woow very good and detailed tutorial , many have knowledge leak when it comes to these stuff ...

[alexlandonflicksss]

Nice tut....it will be better...if this was a video...

[Volim te]

I use htmlentities() myself but great tut anyway.

[VoidEx.]

You forgot to mention htmlspecialchars is only used while parsing the content.
Do not use htmlspecialchars then save a content to a db then parse it.

Yes this exactly.

However I myself do use htmlspecialchars when saving to db for certain things, such as usernames for my website. This is fine. Otherwise, parse on output is the recommended practice.

I use htmlentities() myself but great tut anyway.

If you allow certain tags with htmlentities(), eg <b>, ensure that you are aware of the fact that people can still execute scripts.

Eg:
<b onload='alert(1)'></b>

To the OP:
Well done and thanks for the tutorial :) This should help a lot of people secure their websites.

[KernelMode]

Why make this thread? You can just look at php's site. http://php.net/manual/en/function.htmlspecialchars.php

[Volim te]

Yes this exactly.

However I myself do use htmlspecialchars when saving to db for certain things, such as usernames for my website. This is fine. Otherwise, parse on output is the recommended practice.

If you allow certain tags with htmlentities(), eg <b>, ensure that you are aware of the fact that people can still execute scripts.

Eg:
<b onload='alert(1)'></b>

To the OP:
Well done and thanks for the tutorial :) This should help a lot of people secure their websites.

I mostly add a number is `disallowed` words like javascript, onload, onerror ,document.cookie etc.

[PigBacon]

However I myself do use htmlspecialchars when saving to db for certain things, such as usernames for my website. This is fine. Otherwise, parse on output is the recommended practice.

You know why its the recommended practice?
Because it makes sense.
You should never store escaped data, I mean, what if you want to export it to a CSV file, you'll have HTML escapes all over.

[RebornX]

On the 5th step the image should say "With htmlspecialchars()" ithink.

Nice tutorial though :)

[badbrains]

.. You made a tutorial for a DOCUMENTED function?
.. Why?

http://php.net/htmlspecialchars