Home/ Questions/Q 7587837
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-30T19:46:37+00:00

I am using htmlspecialchars() function to prevent XSS attacks. I have doubt regarding what

  • 0

I am using htmlspecialchars() function to prevent XSS attacks. I have doubt regarding what is the better method to store the data in database from following.

Method 1 : Store the user input values after applying htmlspecialchars() function. Using this it user input "<script>" will become “&lt;script&gt;” .

Method 2 : Store the user input as it is and apply htmlspecialchars() method while retrieving the data and displaying it on the page.

The reason for my doubt is that I believe using method 1 there will be overhead on database, while using method 2 data need to be converted again and again when requested through php. So I am not sure which one is better.

For more information, I am using htmlspecialchars($val, ENT_QUOTES, "UTF-8") so that will convert ‘ and ” as well.

Please help me clear my doubt. Also provide explanation if possible.

Thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    An even better reason is that on truncating to fit a certain space you’ll get stuck with abominations such as "&quo...". Resist the temptation to fiddle with your data more than the minimum required. If you’re worried about reprocessing the data, cache it.

    • 0