WarpConduit Computing

  • Quick Tips
  • Web Design & Development
  • Graphic Design
  • Home
  • WordPress Plugins
  • Password Generator
  • About
  • Contact

Escape HTML Function for Browser Output Prevents XSS (Cross-Site Scripting)

April 20, 2013 by Josh Hartman

I don’t know about you but my fingers get tired of escaping output by typing the long-winded htmlspecialchars($str, ENT_QUOTES, 'UTF-8'); over and over again in small PHP projects that don’t need a full-blown framework with automatic output filtering (e.g. CodeIgniter). No matter how small your project is though filtering your output is extremely important so that you prevent malicious users from executing XSS (Cross-Site Scripting) JavaScript code.

So I decided to give my fingers some relief and finally write a short little helper function and share it. See the code and example in the gist below.

Filed Under: Web Design & Development Tagged With: escape, function, helper, html, htmlspecialchars, output, php, xss

Comments

  1. Andrew wood says

    February 24, 2014 at 2:03 AM

    Hi there ,

    Thanks for your post on php gzip http://www.warpconduit.net/2010/10/23/enabling-gzip-compression-of-php-css-and-js-files-without-mod_deflate/

    Any chance you could give an example to include jpg compression within your code too please? Thanks!

    Regards, andrew

    • Josh Hartman says

      March 7, 2014 at 7:54 AM

      Thanks for the comment. Regarding the compression of file types that are already compressed, like JPG, there is no value since the gzip compression would most likely increase file size and increase CPU overhead by loading PHP and gzipping it. You’re better off serving all static assets from a CDN such as Amazon CloudFront.

      • Andrew Wood says

        March 7, 2014 at 8:19 AM

        Hi There,

        Thanks for the reply.

        I discovered that you don’t compress images etc after I had implemented your code technique and was searching for the answer to the question.

        So, thanks for the reply and thank you very much for the code to get my gzip compression working !

        Best regards, Andrew

Connect

  • Facebook
  • GitHub
  • RSS
  • Twitter
  • YouTube

Recent Posts

  • Extremely Useful Applications for Web Development and IT Tasks
  • Installing BookStack Wiki on cPanel Shared Hosting
  • Media (MIME) Type Reference List

Tags

automatic benchmark cbc cipher class comparisons cpanel credit memo css decrypt encrypt font gzip htaccess html image increment javascript jquery list magento mcrypt mysql number old opencart order php profiling random redirect repository rijndael shipment software strict ubuntu url wincachegrind windows windows 7 wordpress xampp xdebug xss

Blogroll

  • CodeIgniter
  • Fusion Forward
  • jQuery
  • Nettuts+
  • Smashing Magazine

© 2022 WarpConduit Computing. All Rights Reserved.