Why Escaping Output Matters

Last lesson ended with a warning: echoing visitor input straight back out is the most common security mistake on the web. Time to see why, and to fix it forever.

The problem: text that is secretly code

Your greeting page expects a name like Ada. But nothing stops a visitor from typing this into the box instead:

<script>alert("Gotcha!")</script>

Now walk through what your code does. It takes that text and echoes it into the page. The browser receives the page, sees a script tag, and does what browsers do with script tags: it runs the code. The browser has no way to know you meant it as harmless text. Anything that looks like HTML gets treated as HTML.

A popup saying Gotcha is just a prank. But the same trick can run code that steals login cookies, rewrites the page into a fake password form, or silently sends visitors' data elsewhere. This attack has a name, cross-site scripting, XSS for short, and it consistently ranks among the most common vulnerabilities on the entire web. On any page where one user's input is shown to other users, a comment section, a review page, a guestbook, one malicious submission can attack every future visitor.

The fix: htmlspecialchars

PHP ships with a built-in function that makes text harmless: htmlspecialchars(). It converts the characters that have special meaning in HTML into their display-only equivalents: < becomes <, > becomes >, & becomes &, and quotes get the same treatment.

<?php
$name = $_POST["visitor_name"];
echo "Hello, " . htmlspecialchars($name) . "!";
?>

Now if someone submits that script tag, the browser receives <script>... instead of a real tag. The visitor literally sees the text <script>alert("Gotcha!")</script> printed on the page, as inert as any other sentence. Nothing runs. The attack is dead.

The rule to tattoo on your brain

Why every time? Because you cannot reliably predict which input will be dangerous. The safe habit costs one function call. The unsafe habit costs your visitors their accounts. Professional PHP developers are so committed to this that many projects define a tiny shortcut so the safe thing is also the easy thing:

<?php
function e($text) {
    return htmlspecialchars($text);
}
echo "Hello, " . e($name) . "!";
?>

Notice how your skills are stacking: that is a function, from module three, wrapping a built-in, being used on form data from the last lesson. You are writing genuinely professional-grade PHP now.

One clarification before you go: escaping does not mean rejecting. The visitor's text is stored and shown exactly as they typed it. Escaping only changes how the browser interprets it, from live code to plain visible text. A user named O'Brien & Sons stays O'Brien & Sons on screen; they just can't smuggle in a script.