3 ms·
htmlentities() might help to protect you from SQL injection, but it won't do a damn thing against XSS attacks.
by jonursenbach 18y ago
htmlentities() might help to protect you from SQL injection, but it won't do a damn thing against XSS attacks.
- jncraton 18y agoI'll admit that I'm no PHP expert, but I was under the impression that htmlentities prevented XSS by converting all special html characters to their equivalent html entity. If HTML entities works properly, and it is used properly, shouldn't it prevent XSS since an attacker who inputs something like <script>alert("xss")</script> would simply see the message displayed back to them instead of the browser actually executing it?
- jonursenbach 18y agoHmm, yeah you're right. I'm not sure what I was thinking of.