note 89796 added to function.htmlspecialchars

a common confusion among beginner is that what is the difference between htmlentities() and htmlspecialchars() really, because the manual examples are converting angular brackets for both. well, htmlentities() will ALSO look for other language characters in the string e.g German, French or Italian etc. So if you think your attacker can use some foreign language characters for a XSS attack in URL etc then use htmlentities() instead of htmlspecialchars(). I hope it helps, Haroon Ahmad ---- Server IP: 92.48.74.199 Probable Submitter: 94.194.11.237 ---- Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars.php Edit -- https://master.php.net/note/edit/89796 Del: integrated -- https://master.php.net/note/delete/89796/integrated Del: useless -- https://master.php.net/note/delete/89796/useless Del: bad code -- https://master.php.net/note/delete/89796/bad+code Del: spam -- https://master.php.net/note/delete/89796/spam Del: non-english -- https://master.php.net/note/delete/89796/non-english Del: in docs -- https://master.php.net/note/delete/89796/in+docs Del: other reasons-- https://master.php.net/note/delete/89796 Reject -- https://master.php.net/note/reject/89796 Search -- https://master.php.net/manage/user-notes.php