Sanitization removes or encodes dangerous characters from user input. It is distinct from validation — validation checks that data is correct, sanitization makes data safe to use.
htmlspecialchars() — prevents XSS by encoding HTML special characters for output.strip_tags() — removes all HTML and PHP tags from a string.filter_var() with FILTER_SANITIZE_* constants — removes specific character types.Sanitize output, not input. Store raw data in the database and escape at the point of use.
<?php
// htmlspecialchars — THE primary XSS defence for HTML output
$userInput = '<script>alert("XSS")</script>';
echo htmlspecialchars($userInput, ENT_QUOTES | ENT_HTML5, 'UTF-8');
// <script>alert("XSS")</script>
// strip_tags — remove all tags (dangerous: leaves JS in attributes)
$dirty = '<p>Hello <b>World</b> <script>alert(1)</script></p>';
echo strip_tags($dirty); // Hello World alert(1) — NOT safe enough alone!
echo strip_tags($dirty, ['<p>','<b>']); // Allow only <p> and <b>
// filter_var sanitization
$email = filter_var(' user@example.com ', FILTER_SANITIZE_EMAIL);
$url = filter_var('https://exam ple.com', FILTER_SANITIZE_URL);
$int = filter_var('42abc', FILTER_SANITIZE_NUMBER_INT); // "42"
// filter_var validation (returns false on failure)
$validEmail = filter_var($email, FILTER_VALIDATE_EMAIL);
$validUrl = filter_var($url, FILTER_VALIDATE_URL);
$validInt = filter_var('42', FILTER_VALIDATE_INT, [
'options' => ['min_range' => 1, 'max_range' => 100]
]);
var_dump($validEmail); // string or false
var_dump($validInt); // "42" or false
Tip: Never use strip_tags() alone as an XSS defence — it strips tags but leaves event attributes like onmouseover="". Always use htmlspecialchars() when echoing untrusted data into HTML.