output data from database using htmlspecialchars() that has been filtered using filter_input()

Question

I have found from different blogs that it is strongly recommended to use `htmlspecialchars()` to output any data on screen to be safe from `XSS Attack`. I am using `filter_input()` to filter any data that comes from user before inserting into `database`. `filter_input()` convert special characters like `'` to `'` and saved it that way,like ``` I'm going to shopping with Molly's sister;Dolly ``` .My question is `How can I print(output) apostrope or quotes and specific special characters to users screen using htmlspecialchars so that the output would be user friendly` I have tried to use `htmlspecialchars($post,ENT_NOQUOTES);`,but it gives me same copy of data that is stored in database.If I don't use `htmlspecialchars()`,just `$post` gives me expected result,which I think is vulnerable to `XSS Attack` Thanks for your time,and look forward to get help from peers. EDIT I got suggestions to use `htmlspecialchars_decode()` or `html_entity_decode()` on answer,but (https://stacko…

Accepted Answer

I am using `filter_input()` to filter any data that comes from user before inserting into `database`.

This is a bad practice. Do not mangle your data before you insert it into a database. It's 2015; don't sanitize, use prepared statements instead.

```
$db = new \PDO(
    'mysql:host=localhost;dbname=mydatabase;charset=UTF-8',
     $username,
     $password
);

// other stuff in between

$statement = $db->prepare(
    "INSERT INTO yourtable (email, username) VALUES (:email, :username);"
);
$success = $statement->execute([
    ':email'    => $_POST['email'],
    ':username' => $_POST['username']
]);
```

Prepared statements remove the need for `filter_input()`. You're not adding defense in depth by doing this, you're just ruining data integrity and giving yourself a headache.

When you render your output, if you want to allow HTML, use HTML Purifier.

Otherwise, use `htmlspecialchars($output, ENT_QUOTES | ENT_HTML5, 'UTF-8')` for best results.

Recommended Reading: Web Application Security by Taylor Hornby.

output data from database using htmlspecialchars() that has been filtered using filter_input()

Solution

Problem

Related problems