Question

I have a custom forum in which I employ htmlentities so users aren’t able to post malicious code(html/js). Anyway, as I am pulling posts from the database, I use str_replace in order to show certain html elements <, >, &, etc.. is there any harm in doing this? Will it cause side effects/html to render?

Answer 1

1. User posts data
2. Data is escaped for mysql, written to DB
3. User makes request for data
4. Data is encoded for display (aggressively with htmlentities or htmlspecialchars, or some subset of allowed characters. You could do this with str_replace, but there are better utilities).