Prevent XSS Attacks. Escape Strings in PHP

DISCLAIMER: This post may contain “affiliate” links to products and services I recommend. I’ll receive a small commission if you decide to purchase one of these products or services. I only recommend products I genuinely believe will help you in running your freelance business.

Here’s how to prevent XSS attacks by escaping output in PHP:

Here’s the code I used in the video:

What Is XSS?

XSS stands for cross-site scripting and it refers to a type of attack where a hacker injects malicious client-side code into the output of your page.

Applications that don’t escape their output are vulnerable to this type of attack.

XSS Example

A simple example is a blog comment. If not properly escaped, an attacker could enter (for example) JavaScript code into the blog comment.

That code would be stored in the database, output to the page when loaded, and because it’s not escaped… render and run.

Thus, the attacker would have the full range of JavaScript capabilities to attack you and your site visitors.

How to Prevent XSS Attacks

As illustrated in the video above, you prevent XSS attacks by escaping your output using htmlspecialchars() or htmlentities().

Both PHP functions convert problematic characters into HTML entities causing the injected code to be output harmlessly and not rendered.

htmlentities vs htmlspecialchars

Both will prevent XSS attacks. The difference is in the characters each encodes. htmlentities will encode ANY character that has an HTML entity equivalent.

htmlspecialchars ONLY encodes a small set of the most problematic characters.

It’s generally recommended to use htmlspecialchars because htmlentities can cause display problems with your text depending on what characters are being output.

Think of htmlspecialchars as a scalpel and htmlentities as a hammer. Both can solve the problem… one is just a little more precise.

If you get value from this code snippet, please consider sharing it with another developer or group who could benefit from it.

Do you want high-paying freelance clients?

I’ll show you what I learned over the last 15 years about building a 100K freelance business from complete scratch. What I did to land projects with Inc. Magazine, Tim Ferris, Lewis Howes, Michael Hyatt and others. Just enter your email address in the box below and let’s get started:

Leave a Reply on Twitter

Due to excessive spam, I’ve disabled comments on my website. If you have a question or would like to leave a comment, don’t hesitate to contact me on Twitter.

You might also like

Share on facebook
Share on twitter
Share on linkedin
Share on reddit
Share on pinterest
John Morris


I’m a 15-year veteran of freelance web development. I’ve worked with bestselling authors and average Joe’s next door. These days, I focus on helping other freelancers build their freelance business and their lifestyles.

The simple secret to high-paying freelance clients?

Enter your email below and I’ll show how to charge more and build a 100K freelance business from scratch:

Clients Like:

Inc. Magazine Logo
Lewis Howes Logo
Ray Edwards Logo


Ray Edwards

I recommend John every chance I get. If every person I worked with were as committed to excellence, punctuality, value, and unquestionable integrity… the world would be a better place. Highest recommendation.

Chris Aitken

He significantly improved my site through his expert knowledge of PHP, CSS and Javascript. Would definitely recommend John to others.

Lori Grant

John did an outstanding job on my project. I highly recommend him and look forward to working with him on future projects.

Lewis Howes

John is amazing at building membership sites. He converted one of my sites over from it’s existing (hardly working) platform over to the clean and simple to use WishList membership platform. I highly recommend using John and WishList for any of your membership site needs.

Bob Patterson

Not only is John a very talented programmer and developer, he is also an excellent communicator. He has a talent for taking complex subjects and communicating them in terms that anyone can understand. This is a rare combination. This ability has enabled me to take my skills and knowledge to the next level. Thank you John for for all that you do.

Xan Barksdale

Xan Barksdale

Very professional worker who is extremely knowledgable in WordPress and Wishlist Member. I would definitely hire again.

Bradley Smith

John and I have worked together on numerous projects. John is very quick and efficient and was a pleasure to work with.