Question

I am trying to escape some users input in form.

if( !empty($_SESSION['descr']) )
{
    $descr = htmlentities($_SESSION['descr']);
    $descr = stripslashes($descr);
    $descr = html_entity_decode($descr); 

    echo"<textarea cols=\"50\" rows=\"10\" name=\"descr\" >".$descr."</textarea>";
}
else
{
    echo "<textarea cols=\"50\" rows=\"10\" name=\"descr\" ></textarea>";
}

I didn’t use html_entity_decode() in the first place then I realized if a user put some French characters then it won’t show them correctly.
Is it save to use it the way it is with html_entity_decode()?

Answer 1

You should change the encoding of the string to ISO-8859-15, which picks up characters that LATIN-1 misses (ie french characters):

$descr = htmlentities($desc,ENT_COMPAT,'ISO-8859-15');

ENT_COMPAT may not be the flag you are looking for, but you can find a subtitle in the manual.