What are some common pitfalls to avoid when using functions in PHP to output content within HTML elements?

One common pitfall to avoid when using functions in PHP to output content within HTML elements is not properly escaping the content, which can lead to security vulnerabilities like cross-site scripting (XSS) attacks. To solve this issue, always use htmlspecialchars() or htmlentities() functions to escape any user input before outputting it within HTML elements. 

<?php
// Unsafe way
function outputContent($content) {
    echo "<div>$content</div>";
}

// Safe way
function outputContent($content) {
    echo "<div>" . htmlspecialchars($content) . "</div>";
}

// Example usage
$output = "<script>alert('XSS attack');</script>";
outputContent($output);
?>

Keywords

echo htmlspecialchars XSS htmlentities escaping

Related Questions