WarpConduit Computing

  • Quick Tips
  • Web Development
  • WordPress Plugins
  • Home
  • Passphrase Generator
  • Password Generator
  • About
  • Contact

Escape HTML Function for Browser Output Prevents XSS (Cross-Site Scripting)

April 20, 2013 by Josh Hartman

I don’t know about you but my fingers get tired of escaping output by typing the long-winded htmlspecialchars($str, ENT_QUOTES, 'UTF-8'); over and over again in small PHP projects that don’t need a full-blown framework with automatic output filtering (e.g. CodeIgniter). No matter how small your project is though filtering your output is extremely important so that you prevent malicious users from executing XSS (Cross-Site Scripting) JavaScript code.

So I decided to give my fingers some relief and finally write a short little helper function and share it. See the code and example in the gist below.

Filed Under: Web Development Tagged With: escape, function, helper, html, htmlspecialchars, output, php, xss

Comments

  1. Andrew wood says

    February 24, 2014 at 2:03 AM

    Hi there ,

    Thanks for your post on php gzip http://www.warpconduit.net/2010/10/23/enabling-gzip-compression-of-php-css-and-js-files-without-mod_deflate/

    Any chance you could give an example to include jpg compression within your code too please? Thanks!

    Regards, andrew

    • Josh Hartman says

      March 7, 2014 at 7:54 AM

      Thanks for the comment. Regarding the compression of file types that are already compressed, like JPG, there is no value since the gzip compression would most likely increase file size and increase CPU overhead by loading PHP and gzipping it. You’re better off serving all static assets from a CDN such as Amazon CloudFront.

      • Andrew Wood says

        March 7, 2014 at 8:19 AM

        Hi There,

        Thanks for the reply.

        I discovered that you don’t compress images etc after I had implemented your code technique and was searching for the answer to the question.

        So, thanks for the reply and thank you very much for the code to get my gzip compression working !

        Best regards, Andrew

Connect

  • Facebook
  • GitHub
  • RSS
  • Twitter
  • YouTube

Recent Posts

  • How to Permanently Remove the “Learn about this picture” Spotlight Wallpaper Icon From Your Windows Desktop
  • How to Quickly Test a Fax Machine
  • Extremely Useful Applications for Web Development and IT Tasks

Tags

automatic benchmark bigint class composer css embed escape event font function gzip helper htaccess html htmlspecialchars image increment javascript jquery list magento media mysql number observer opencart order output photo php profiling random redirect rijndael software text type ubuntu url windows windows 7 wordpress xampp xss

Blogroll

  • CodeIgniter
  • Fusion Forward
  • jQuery
  • Nettuts+
  • Smashing Magazine

© 2025 WarpConduit Computing. All Rights Reserved.