Question

This gives me error

$illegal = array("&", "<", ">", "\");
$legal = array("&amp;", "&lt;", "&gt;", "&quot;");

$row['name'] = str_replace($illegal, $legal, $row['name']);

this is the main part of the code

$xml_output = "<?xml version=\"1.0\"?>\n";
$xml_output .= "<products>\n";

for($x = 0 ; $x < mysql_num_rows($resultID) ; $x++){
    $row = mysql_fetch_assoc($resultID);
    $xml_output .= "\t<product>\n";
    $xml_output .= "\t\t<id>" . $row['id'] . "</id>\n";
        // Escaping illegal characters
$illegal = array("&", "<", ">", "\");
$legal = array("&amp;", "&lt;", "&gt;", "&quot;");

$row['name'] = str_replace($illegal, $legal, $row['name']);


    $xml_output .= "\t\t<name>" . $row['name'] . "</name>\n";
    $xml_output .= "\t</product>\n";
}

$xml_output .= "</products>";

echo $xml_output;

My 2 questions are

1. Is the first block of code that works, faster or equal to the second?
2. If the second block is faster, how can I fix it ?

Thank you.

Answer 1

$illegal = array("&", "<", ">", "\");

should be

$illegal = array("&", "<", ">", '"');

Furthermore, have a look at using htmlspecialchars instead of your own solution.