How to sanitize user input to prevent XSS in PHP?
To prevent XSS in PHP, sanitize user input and escape output based on context using htmlspecialchars() for HTML, json_encode() for JavaScript, and validate strictly with filter_var() for expected data types, while avoiding deprecated functions and using Content-Security-Policy headers for added protection.
To prevent Cross-Site Scripting (XSS) in PHP, properly sanitizing user input is essential. The goal is to ensure that any data received from users—whether through forms, URLs, or APIs—cannot be interpreted as executable code by the browser. Here’s how you can effectively sanitize input and secure your application.
Escape Output Based on Context
Never rely solely on sanitizing input; always escape output depending on where it's being used in the page. This is the most effective way to prevent XSS.
- Use htmlspecialchars() when outputting data into HTML content: echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');
- For JavaScript contexts, use json_encode() to safely embed data: <script>var userData = <?= json_encode($userInput, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT); ?>;</script>
- When inserting into CSS or URLs, apply stricter filtering or validation, as htmlspecialchars() won’t protect those contexts.
Validate Input Strictly
Sanitization works best alongside strong validation. Only allow expected data types and formats.
- For numbers: use filter_var() with FILTER_VALIDATE_INT or FILTER_VALIDATE_FLOAT
- For emails: filter_var($email, FILTER_VALIDATE_EMAIL)
- For strings: define allowed patterns using regular expressions or check against a whitelist of characters
- Reject input that doesn’t match expectations instead of trying to “clean” everything
Use Built-in Filter Functions for Sanitization
PHP provides the filter_var() function to sanitize common input types:
- Remove tags and encode special chars: filter_var($input, FILTER_SANITIZE_STRING) (deprecated in PHP 8.1 , so avoid in new projects)
- Sanitize email: filter_var($email, FILTER_SANITIZE_EMAIL)
- Sanitize URL: filter_var($url, FILTER_SANITIZE_URL)
In modern PHP versions, prefer manual validation and escaping over deprecated filters.
Avoid Raw User Input in Dangerous Contexts
Never insert user data directly into HTML attributes, JavaScript, CSS, or SQL without proper handling.
- Don’t use user input in eval(), innerHTML, or dynamic script blocks
- If you must accept HTML (e.g., from a rich text editor), use a trusted library like HTML Purifier to whitelist safe elements and strip malicious scripts
- Set Content-Security-Policy (CSP) headers to reduce impact of potential XSS
Basically, sanitize cautiously, validate strictly, and escape thoroughly at output. Relying on one method isn’t enough—layered defense keeps your app safer.
The above is the detailed content of How to sanitize user input to prevent XSS in PHP?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

ArtGPT
AI image generator for creative art from text prompts.

Stock Market GPT
AI powered investment research for smarter decisions

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Singleton pattern ensures that a class has only one instance and provides a global access point for scenarios where a single object coordinates the operation of the system, such as database connections or configuration management. 2. Its basic structure includes: private static attribute storage instances, private constructors prevent external creation, private cloning methods prevent copying, and public static methods (such as getInstance()) for obtaining instances. 3. Get a unique instance in PHP by calling getInstance() method, and returns the same object reference no matter how many times it is called. 4. Under the standard PHP request model, thread safety is not necessary to be considered, but synchronization issues need to be paid attention to in long run or multi-threaded environments, and PHP itself does not support native lock mechanism. 5. Although singletons are useful,

Answer: PHP's empty merge operator (??) is used to check whether a variable or array key exists and is not null. If it is true, it returns its value, otherwise it returns the default value. It avoids the use of lengthy isset() checks, is suitable for handling undefined variables and array keys, such as $username=$userInput??'guest', and supports chain calls, such as $theme=$userTheme??$defaultTheme??'dark', which is especially suitable for form, configuration, and user input processing, but only excludes null values, empty strings, 0 or false are considered valid values to return.

Use $_GET to get URL parameters, such as ?name=John&age=25; check existence through isset or empty merge operators, and filter and verify data with filter_input to ensure security.

The direct link for manwa2 web version is http://www.manwaw.cn/. The platform provides a large number of high-definition comic resources, supports online search, offline cache and multi-terminal synchronization, and has personalized book lists and reading settings functions to ensure users' smooth and comfortable comic-chasing experience.

TodisableaPHPfunction,usedisable_functionsinphp.iniforbuilt-infunctionslikeexecorsystem,whichblocksthemgloballyforsecurity;foruser-definedfunctions,preventexecutionbywrappingtheminconditions,renaming,commentingout,orcontrollingfileinclusionviaautoloa

Answer: Use file_get_contents and cURL to download URL files, the former is simple but restricted, while the latter is more flexible and supports streaming. Examples include directly reading and writing files, cURL initialization setting options and saving, adding error handling and HTTP status checking. Large files are recommended to stream download in blocks to save memory, ensuring that the directory is writable and handle exceptions properly.

Use the implements keyword to implement the interface, and the class must provide specific implementations of all methods in the interface. 2. Define the interface to declare the method using the interface keyword. 3. Class implements interface and overrides methods. 4. Create an object and call the method to output the result. 5. A class can implement multiple interfaces to ensure code specification and maintainability.

Use the & symbol to implement reference passing before function parameters, so that the function directly modifys the original variable. For example, after defining functionincrement(&$value){$value;}, calling increment($number) will change the value of $number; reference passing does not need to be used in the call, but only needs to be used in the function declaration; you can also return the reference through &function&getGlobalRef(), so that $ref=&getGlobalRef() points to a static variable and modify its value.
