Are there any best practices for sanitizing user input in PHP to prevent HTML injection?

To prevent HTML injection in PHP, it is recommended to use the htmlentities() function to sanitize user input. This function converts special characters to HTML entities, preventing them from being interpreted as HTML tags. This helps to protect against cross-site scripting (XSS) attacks. 

$user_input = "<script>alert('Hello');</script>";
$sanitized_input = htmlentities($user_input);
echo $sanitized_input;

Keywords

htmlspecialchars filter_var htmlentities strip_tags validation

Related Questions