XSS Prevention
XSS occurs when user input is echoed unescaped into HTML. Escape output with htmlspecialchars() at the point of rendering.
PHP
Beginner
4 min read
Cross-Site Scripting (XSS)
Example
// Vulnerable
echo "Hello, " . $_GET["name"];
// Safe: escape at output
echo "Hello, " . htmlspecialchars($_GET["name"], ENT_QUOTES | ENT_HTML5, "UTF-8");
// In Blade (Laravel) — escaped by default
{{ $name }} // safe — auto-escaped
{!! $html !!} // raw — only for trusted HTML Pro Tip
Escape at the output layer, not the input layer — the same data may be used in HTML, JS, and SQL differently.