note 51451 added to function.htmlentities

art at zollerwagner dot com: You DO need to htmlentities() data that you will be placing in a textarea field. Imagine that a user were to submit the following data to be placed in the field: </textarea> <script type="text/javascript" src="[some evil script here]"></script> <textarea> If you didn't htmlentities() the data, that would close the textarea, include the user's potentially malicious script, and then open a new textarea (optional, but preserves code validity). A classic XSS attack. ---- Manual Page -- http://www.php.net/manual/en/function.htmlentities.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+51451 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+51451&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+51451&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+51451&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+51451&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+51451&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+51451&report=yes Search -- http://master.php.net/manage/user-notes.php