storing code snippets in a database

Question

I want to make a code snippet database web application. Would the best way to store it in the database be to html encode everything to prevent XSS when displaying the snippets on the web page?

Thanks for the help!

Answer 1

The database has nothing to do with this; you simply need to escape the snippets when they are rendered as HTML.

At minimum, you need to encode all & as & and all < characters as <.

However, your server-side language already has a built-in HTML encoding function; you should use it instead of re-inventing the wheel. For more details, please tell us what language your server-side code is in.

Based on your previous questions, I assume you're using PHP.
If so, you're looking for the htmlspecialchars or htmlentities functions.