PHP htmlentities () input and output

Question

Possible duplicate:
PHP htmlentities () at the input before inserting the database, not at the output

For a PHP application that is simply trying to protect itself against XSS-like ones, at what stage should the htmlentities() function be called? Should it be called on the user's initial input or on each page showing where this data is displayed?

If I use htmlentities() on user input, I end up storing a little more data in the database. However, in the end, I save the processor cycles, because I only need to perform the conversion on the input and never again perform the subsequent output of this data.

I should note that I do not see any predictable case of ever storing embedded HTML data in my application, so using htmlentities() intended solely to protect XSS. In the unlikely event that I ever need raw HTML, I can just call html_entity_decode() to reverse htmlentities() . In addition, it saves me from forgetting to call htmlentities() to render the page and accidentally paste the XSS exploit into my application.

I played with the idea of ​​using the XHP extension on Facebook, but parsing XML is pretty much overhead, more than what I like in my application.

Summary: Should I use htmlentities() for input or output? What is the general, generally accepted approach to this situation?

Answer 1

If you cannot guarantee that for the entire life of your application, the input will be sent only to the web browser, the question is not discussed: you should use XSS protection on the output, because otherwise you will have to massify your output data (regardless of the type of output that may be) in each case. This is exactly your current argument for applying input protection.

Seeing how unlikely that the above is true even now (not to mention the unspecified future) IMHO, the answer is obvious.

Answer 2

I prefer to use it on the output, in order to keep it open for using the same data without any html versions of the outputs.

Answer 3

There is no reason for this at the entrance.

If you need high performance, just create 2 fields: text, escaped_text and fill in the second field on the 1st output and reset when updating.

If you use the template engine, it will avoid all data for you.