5 ms·
It's not just you. They don't use htmlentities at all.
by jncraton 18y ago
It's not just you. They don't use htmlentities at all.
- jonursenbach 18y agohtmlentities() might help to protect you from SQL injection, but it won't do a damn thing against XSS attacks.
- jncraton 18y agoI'll admit that I'm no PHP expert, but I was under the impression that htmlentities prevented XSS by converting all special html characters to their equivalent html entity. If HTML entities works properly, and it is used properly, shouldn't it prevent XSS since an attacker who inputs something like <script>alert("xss")</script> would simply see the message displayed back to them instead of the browser actually executing it?
- jonursenbach 18y agoHmm, yeah you're right. I'm not sure what I was thinking of.