How to echo a $_GET safely? [duplicate]

Question

<?php
    echo $_GET['id'];
?>

Doesn't look very safe to me.. What is our best option to show an GET element?

Something like a preg_replace on all the special characters, or htmlspecialchars?

Answer 1

Depends on what you are doing to do with $_GET['id'];

If you are looking to insert it into database , Just make use of Prepared Statements. [That suffices]

If you just want to display it on your HTML page, make use of this code.

<?php
    echo htmlentities($_GET['id']);
?>

Answer 2

<?php
    echo htmlspecialchars($_GET['id']);
?>