note 99185 deleted from function.htmlspecialchars by cmb

Note Submitter: Anonymous ---- This may seem obvious, but if you want to output arbitrary (i.e. user-input) data as an attribute inside an HTML tag (such as the INPUT tags on a FORM), be aware of whether you are using ENT_QUOTES or ENT_COMPAT. If you're using ENT_COMPAT, the attribute must be wrapped in double-quotes, as single-quotes will not be encoded and the user will be able to inject arbitrary HTML attributes (including javascript behavior) inside the tag, even though they will not be able to inject arbitrary HTML tags. Also, if you want to allow users to input HTML attributes without them being double-encoded on display, there are two ways to accomplish this: 1 - Run their input through htmlentities_decode() followed by htmlspecialchars(). 2 - Call htmlspecialchars() with $double_encode=false. There is one functional difference between these two methods: If you want to perform any search-replace on a user's input (such as word censoring in a message-board application), the second method will allow users to circumvent it by HTML-encoding their input, whereas the first will not.