Question

With PHP, which function is best to be used with $_GET[] values to make them browser safe?

I have read up on a few htmlspecialchars() and htmlentities(). Should one of those be used or is there another function that would work better?

Answer 1

Using htmlspecialchars suffices to encode the HTML special characters. htmlentities is only necessary if you want to use characters that can not be encoded with the character encoding you are using.

But make sure to specify the quote_style parameter when you want to use the output in an attribute value quoted with single quotes like:

echo "<input type='text' value='".htmlspecialchars($_GET['foobar'], ENT_QUOTES)."'>";

And to specify the charset parameter when you’re using a character encoding other than ISO 8859-1:

echo htmlspecialchars($_GET['foobar'], ENT_QUOTES, 'UTF-8');