Should I use htmlentities() on all output? (preventing XSS attacks)

Question

Possible Duplicate:
What are the best practices for avoiding xss attacks in a PHP site
What are the common defenses against XSS?

I'm trying to make a PHP application I've written secure and have a question about escaping output. I switched to using prepared statements with PDO once I learned doing so would prevent SQL injections, and it seems that the other main type of attack is XSS. I build the output for my pages like this (assume the variables have data from the database in them):

$output = '';

$output .= '
<div style="float: left; width: 800px;">
    <span>Name:</span><span> ' . $name . '</span>
    <span>Address:</span><span>' . $addr . '</span>
    <span>Time:</span><span>' . time() . '</span>
</div>';

$output .='[lots more html]';

So, my question is, should I use htmlentities() around every piece of data from the database being output (a typical page has dozens, some possibly hundreds, of variables from the database being output)?

Answer 1

There are two benefits to using htmlentities():

• XSS prevention
• Converting special characters to proper HTML entities, for example it converts the copyright character to ©. In HTML content you should use the appropriate HTML entity instead of inserting a raw special character.

For XSS prevention, you could use htmlspecialchars() instead, but it will only convert some basic characters to HTML entities, namely quotes, ampersand and the less than/greater than characters.

In answer to your question, you should use htmlentities() when outputting any content that could contain user input or special characters.

Answer 2

htmlspecialchars() is more than enough. htmlentities is for different use, not preventing XSS.