UTF8 character encoding, htmlentities and Cross Site Scripting

Question

I am currently overworking my website and would like to make consequent usage of correct character encoding since I had some with this trouble so far.

My HTML and PHP files are encoded with UTF8, my HTML head looks like this:

<!DOCTYPE html><html><head><meta charset="utf-8" />.....

I use MySQLi and configured my connection like this:

$DB->set_charset("utf8");

My database is using utf8_general_ci collation.

So I think I set up everything correctly.

Now my problem: To avoid cross site scripting I everytimes use htmlentities() when displaying data the user has saved into my database in order to break HTML characters like < > " '

echo(htmlentities($str, ENT_QUOTES, "UTF-8"));

But when $str contains other special characters like ÄäÖöÜü&ßàé they also get broken and my browser only displays only & Auml; and so on...

Where is my fault? What is the correct method to achieve safety against xss and display utf-8 characters? I think I could need a complete crash course within these topics. This solution does not match my problem because I already use this parameter.

I would be very thankful if you could help me with this issue. Best regards Lukas

Could it be a locale problem? What if you set the locale for your php process to a UTF8 one if it's not like that already? — Gabor Lengyel
Hey, thanks for your answer! You mean the default_charset setting within my php.ini ? I set it to "UTF-8" but it did not make any effect... I am not really sure if htmlentities is the correct function for me link? What means "all applicable characters" ? — lukasl1991

lukasl1991 lukasl1991 · Accepted Answer · 2016-11-17T17:23:16

I could fix this issue by switching to htmlspecialchars. I think this function does enough for security against xss.

UTF8 character encoding, htmlentities and Cross Site Scripting

1 Answers