In the provided PHP code snippet, what are some potential pitfalls or security vulnerabilities related to directly embedding variables in HTML output?

Directly embedding variables in HTML output can lead to security vulnerabilities such as cross-site scripting (XSS) attacks. If the variable contains user input that is not properly sanitized, an attacker could inject malicious scripts into the page. To mitigate this risk, it's important to always properly escape and sanitize user input before outputting it in HTML. 

<?php
// Example of properly escaping and sanitizing user input before outputting in HTML
$user_input = "<script>alert('XSS attack!')</script>";

// Sanitize and escape the user input before embedding it in HTML
$sanitized_input = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');

// Output the sanitized input in HTML
echo "<p>User input: " . $sanitized_input . "</p>";
?>

Keywords

XSS Cross-site scripting htmlspecialchars input validation output encoding

Related Questions