Home/ Questions/Q 4590018
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T22:10:54+00:00

I’d like to know if its really necessary escape my string with htmlentities($str, ENT_QUOTES,

  • 0

I’d like to know if its really necessary escape my string with htmlentities($str, ENT_QUOTES, “UTF-8”) before print on an html textarea.

Or automatically this one escape for me the characters?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Yes, it is necessary.

    Otherwise, a </textarea> in the input data would mess up your markup.

    <textarea> <--------------------------- Your tag

  </textarea> <------------------------ User input      
  <script>alert("Hello!");</script> <-- User input, XSS injection

</textarea> <-------------------------- Your tag
    • 0