Is it necessary to filter/escape unsafe variables in <title> or other tags in <head> to prevent XSS?
2
votes
Just because you don't know how to hack something, doesn't mean you shouldn't sanitize it anyways. As somebody below pointed out, there is a way to XSS your webpage, always assume there is a way and never cut corners on your sanity checking.
- TravisO
2 Answers
11
votes
Strictly speaking it is necessary to do htmlspecialchars() on absolutely everything you output to a web page from PHP.
If you come to a point where this produces a wrong result (i.e. HTML code is showing up in the browser because of double encoding) you have found a design flaw in your application.
XSS would not be a problem if people would stick to this simple rule.
