Script 13.4 Prevent XSS Attacks

Output

Suggested text to copy and paste:

<b>be nice</b><br /><script>alert('hello');</script> d&uuml;ring t&egrave;sting.<br />&#9801;

Source
<?php # Script 13.4 - xss.php

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

	// Apply the different functions, printing the results:
	echo "<div class='message'><h2>Results</h2><dl>";
	echo "<dt><b>Original - Unfiltered</b></dt><dd>{$_POST['data']}<dd><br />";
	echo '<dt><b>htmlspecialchars()  </b></dt><dd>' . htmlspecialchars($_POST['data'], ENT_QUOTES,'utf-8'). '</dd><br/>';
	echo '<dt><b>htmlentities()  </b></dt><dd>' . htmlentities($_POST['data'], ENT_QUOTES,'utf-8'). '</dd><br/>';
	echo '<dt><b>strip_tags()  </b></dt><dd>' . strip_tags($_POST['data']). '</dd>';
	echo '</dl></div>';

}
// Display the form:
?>
<form action="<?php echo htmlentities( $_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'] ); ?>" method="post">
	<p>
		<label for="d">Enter some text</label>
		<textarea id="d" name="data" rows="3" cols="40"></textarea>
	</p>
	<p>
		Suggested text to copy and paste:<br />
		<?php 
		echo '<pre>'; 
		echo htmlspecialchars("<b>be nice</b><br /><script>alert('hello');</script> d");
		echo htmlentities('&uuml;');
		echo "ring t";
		echo htmlentities('&egrave;');
		echo htmlspecialchars("sting.<br />");
		echo htmlentities('&#9801;');   
		echo '</pre>';
		?>
	</p>
	<p>
		<input type="submit" name="submit" value="Submit" />
	</p>
</form>