My application will accept textarea content that is submitted by a user, and i would like some people to review my code to make sure there is no security vulnerability such as XSS.
My mySQL column that will save this information is a column of type
TEXT and is not required and nullable.
When storing the data to database, my script is doing the following:
// to avoid inserting html tags in the database $input = str_replace(["<", ">"],"", $_POST['userinput']) // to avoid saving problematic characters such as quotes $cleanInput = htmlentities(input , ENT_QUOTES) // store the content $addPostStmt = $conn -> prepare(" INSERT INTO posts(description) VALUES ( ?) "); $addPostStmt -> bind_param("s", $cleanInput); $addPostStmtExecute = $addPostStmt -> execute();
When presenting the data to the user, the script is doing the following:
<?php echo htmlspecialchars(html_entity_decode($post['description']), ENT_SUBSTITUTE); ?>