note 89796 deleted from function.htmlspecialchars by cmb
| From: | cmb@php.net | Date: | Sun, 27 Oct 2019 09:16:17 +0000 |
| Subject: | note 89796 deleted from function.htmlspecialchars by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-212846@lists.php.net to get a copy of this message | ||
Note Submitter: hello at haroonahmad dot co dot uk
----
a common confusion among beginner is that what is the difference between htmlentities() and
htmlspecialchars() really, because the manual examples are converting angular brackets for both.
well, htmlentities() will ALSO look for other language characters in the string e.g German, French
or Italian etc. So if you think your attacker can use some foreign language characters for a XSS
attack in URL etc then use htmlentities() instead of htmlspecialchars().
I hope it helps,
Haroon Ahmad