How can HTML output in text fields be prevented in PHP?

To prevent HTML output in text fields in PHP, you can use the htmlspecialchars function to escape special characters before displaying the input in the text field. This will ensure that any HTML tags or special characters are displayed as plain text and not rendered as HTML. 

<?php
$input = "<script>alert('XSS attack');</script>";
echo '<input type="text" value="' . htmlspecialchars($input) . '">';
?>

Keywords

PHP htmlspecialchars XSS security input validation

Related Questions