Escape output in a PHP template

Php

htmlspecialchars with the flags spelled out, because the defaults have changed between versions.

<?php
function e(?string $value): string {
    return htmlspecialchars($value ?? '', ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
?>
<p><?= e($comment) ?></p>

Download

PHP php security xss templates chris

More in PHP

Hash and verify a password in PHP PHP password_hash picks the algorithm and the salt. Never store anything a hash function can reverse. Prepared statement with PDO PHP Placeholders rather than interpolation. This is the whole of SQL injection defence in PHP.

Random picks

A starting Content-Security-Policy Security Blocks inline script and restricts everything to the origin. Tighten from here rather than loosening from nothing. Pretty-print and query JSON Text Processing jq for the common cases: reformat, pick a path, filter an array, and reshape. Type a fetch response safely TypeScript unknown forces a parse step rather than letting an any spread silently through the codebase. Centre a box, two ways Web & CSS Grid is one line. Flex is three and gives you control over the axes separately. A Makefile that documents itself Build & CI Running make with no arguments prints every target that carries a comment. Time a block of code Python A context manager that prints how long its body took, without scattering time.perf_counter calls through the function. Group an array by a key JavaScript Object.groupBy is available in current runtimes; the reduce version is the fallback for older ones. RAII file handling in C++ Systems The stream closes itself when it leaves scope, whether the function returns normally or throws.