Why my code vulnerable to xss attack?

Question

I have php code like this

<?php
    $input_from_user = "w' onclick = 'alert(document.cookie);'";
    $i_am_barcelona_fan = htmlentities($input_from_user);
?>
<input type = 'text' name = 'messi_fan' value ='<?php echo $i_am_barcelona_fan;?>' />

I am using htmlentities to protect from XSS attack, but still I am vulnerable to the above string. Why is my code vulnerable to XSS attack? How can I protect from my code from it?

Answer 1

You're not telling PHP to escape quotes as well, and you should use htmlspecialchars() instead:

<input type = 'text' name = 'messi_fan' value ='<?php echo htmlspecialchars($input_from_user, ENT_QUOTES, 'UTF-8'); ?>' />

Demo