What are the potential issues with using variables inside HTML attributes in PHP?

Using variables inside HTML attributes in PHP can lead to potential security vulnerabilities like cross-site scripting (XSS) attacks if the variable is not properly sanitized. To prevent this, it is important to properly escape the variable before outputting it in the HTML attribute. This can be done using functions like htmlspecialchars() to encode special characters. 

<?php
$name = "<script>alert('XSS attack!')</script>";
echo "<input type='text' value='" . htmlspecialchars($name, ENT_QUOTES) . "'>";
?>

Keywords

XSS htmlspecialchars htmlentities escaping security

Related Questions