Protection against XSS exploits?

Question

I'm newish to PHP but I hear XSS exploits are bad. I know what they are, but how do I protect my sites?

Answer 1

To prevent from XSS attacks, you just have to check and validate properly all user inputted data that you plan on using and dont allow html or javascript code to be inserted from that form. Or you can you Use htmlspecialchars() to convert HTML characters into HTML entities. So characters like <> that mark the beginning/end of a tag are turned into html entities and you can use strip_tags() to only allow some tags as the function does not strip out harmful attributes like the onclick or onload.

Answer 2

Escape all user data (data in the database from user) with htmlentities() function.

For HTML data (for example from WYSIWYG editors), use HTML Purifier to clean the data before saving it to the database.