Question

In a registration procedure, after a user has successfully registered, I need to output the user entered information such as, user name, password, security question, etc. back to a welcome page.

My question is what some good practice I should follow in order to output the user enter info on a page?

For example,

echo htmlentities($user_name);
echo htmlentities($user_password);
echo htmlentities($user_secrete_answer);

Thank you

Answer 1

Using htmlentities is fine to prevent attacks where HTML is injected (like XSS); in fact, you could even use just htmlspecialchars that suffices to encode the special characters of HTML (remember to set the quote_style parameter to ENT_QUOTES if you want to insert the data into a HTML attribute value wrapped in single quotes).

But you should not print every data that is sent to your application. The password is a datum that should not be returned to the user in any way to prevent a disclosure of this information:

If the […] password is displayed on the screen, it can be seen by shoulder surfers. So it is a good idea not to display the password […]

Furthermore, the password should never be stored in plain text but only as a hash, if possible using an additional salt.