Question

I need to send a message from a Flash contact form to PHP. Do I need to encode characters like ‘ ” < > & because of possible XSS attacks or something else?

Answer 1

Yes but not because of XSS for your case. You don’t want to interfere your db query string which is using single or double quotes. Within PHP, escape your $_POST or $_GET vars with this

$myString = mysql_real_escape_string($myString);

If your outputting this data on an HTML page, do this on the output page

echo htmlentities($row['columnName'], ENT_QUOTES);

You may optionally do the above script before you insert it into the database too