What are the potential consequences of not properly escaping variables in HTML code within a PHP script?

Not properly escaping variables in HTML code within a PHP script can lead to security vulnerabilities such as cross-site scripting (XSS) attacks. To prevent this, you should always properly escape user input before outputting it in HTML. 

<?php
$name = "<script>alert('XSS attack!')</script>";
echo htmlentities($name, ENT_QUOTES, 'UTF-8');
?>

Keywords

XSS security vulnerability htmlentities htmlspecialchars input validation

Related Questions