What are some common pitfalls to avoid when outputting HTML in PHP code?

One common pitfall to avoid when outputting HTML in PHP code is not properly escaping user input, which can lead to cross-site scripting (XSS) vulnerabilities. To prevent this, always use htmlspecialchars() or htmlentities() functions to escape any user input before outputting it to the browser. 

// Example of properly escaping user input before outputting HTML
$userInput = "<script>alert('XSS attack');</script>";
echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');

Keywords

XSS Cross-site scripting htmlspecialchars htmlentities output escaping

Related Questions