Question

I need a form that retains it’s values on error, but makes sure the input data is clean security wise.

<form action="" method="POST">
    <div>
         <label for="first_name">First Name</label>
         <input type="text" name="first_name" value="$_POST['first_name']"/>
    </div>
</form>

What should I do to the $_POST[‘first_name’] to make it safe and not vulnerable?

Answer 1

Use htmlspecialchars to remove any possiblity of harmful XSS attacks:

echo '<input type="text" name="first_name" value="'.htmlspecialchars($_POST['first_name']).'"/>';