echo+htmlentities is not working propely?
I have this code:
$title = 'Alguém';
<h1><?php echo htmlentities($title, ENT_QUOTES, 'UTF-8', false); ?></h1>
PS: this is just a example, on my current code i get the value of $title from my database.
the result that can be seen on the web page:
<h1>Alguém</h1>
And the result that can be seen on the view-source::
<h1>Alguém</h1>
Why this happens? Am i using htmlentities correctly?
php echo html-entities
asked Jan 2 at 6:13
NatalieNatalie
727
|
show 3 more comments
I have this code:
$title = 'Alguém';
<h1><?php echo htmlentities($title, ENT_QUOTES, 'UTF-8', false); ?></h1>
PS: this is just a example, on my current code i get the value of $title from my database.
the result that can be seen on the web page:
<h1>Alguém</h1>
And the result that can be seen on the view-source::
<h1>Alguém</h1>
Why this happens? Am i using htmlentities correctly?
php echo html-entities
asked Jan 2 at 6:13
NatalieNatalie
727
Your example code works fine. Seems like there is some issue with the tag missmatch in php file
– Nishant Saini
Jan 2 at 6:29
When you sayview sourceare you just saying that the source code for the html on your web page shows<h1>Alguém</h1>?
– Joseph_J
Jan 2 at 6:32
@Joseph_J yes, theview-source:https://example.comshould i worry about it?
– Natalie
Jan 2 at 6:33
@NishantSaini tag missmatch? what do you mean?
– Natalie
Jan 2 at 6:35
@Natalie Opening and closing php tags
– Nishant Saini
Jan 2 at 6:36
|
show 3 more comments
I have this code:
$title = 'Alguém';
<h1><?php echo htmlentities($title, ENT_QUOTES, 'UTF-8', false); ?></h1>
PS: this is just a example, on my current code i get the value of $title from my database.
the result that can be seen on the web page:
<h1>Alguém</h1>
And the result that can be seen on the view-source::
<h1>Alguém</h1>
Why this happens? Am i using htmlentities correctly?
php echo html-entities
asked Jan 2 at 6:13
NatalieNatalie
727
I have this code:
$title = 'Alguém';
<h1><?php echo htmlentities($title, ENT_QUOTES, 'UTF-8', false); ?></h1>
PS: this is just a example, on my current code i get the value of $title from my database.
the result that can be seen on the web page:
<h1>Alguém</h1>
And the result that can be seen on the view-source::
<h1>Alguém</h1>
Why this happens? Am i using htmlentities correctly?
php echo html-entities
php echo html-entities
asked Jan 2 at 6:13
NatalieNatalie
727
asked Jan 2 at 6:13
NatalieNatalie
727
asked Jan 2 at 6:13
NatalieNatalie
727
asked Jan 2 at 6:13
NatalieNatalie
727
asked Jan 2 at 6:13
NatalieNatalie
727
727
Your example code works fine. Seems like there is some issue with the tag missmatch in php file
– Nishant Saini
Jan 2 at 6:29
When you sayview sourceare you just saying that the source code for the html on your web page shows<h1>Alguém</h1>?
– Joseph_J
Jan 2 at 6:32
@Joseph_J yes, theview-source:https://example.comshould i worry about it?
– Natalie
Jan 2 at 6:33
@NishantSaini tag missmatch? what do you mean?
– Natalie
Jan 2 at 6:35
@Natalie Opening and closing php tags
– Nishant Saini
Jan 2 at 6:36
|
show 3 more comments
Your example code works fine. Seems like there is some issue with the tag missmatch in php file
– Nishant Saini
Jan 2 at 6:29
When you sayview sourceare you just saying that the source code for the html on your web page shows<h1>Alguém</h1>?
– Joseph_J
Jan 2 at 6:32
@Joseph_J yes, theview-source:https://example.comshould i worry about it?
– Natalie
Jan 2 at 6:33
@NishantSaini tag missmatch? what do you mean?
– Natalie
Jan 2 at 6:35
@Natalie Opening and closing php tags
– Nishant Saini
Jan 2 at 6:36
Your example code works fine. Seems like there is some issue with the tag missmatch in php file
– Nishant Saini
Jan 2 at 6:29
Your example code works fine. Seems like there is some issue with the tag missmatch in php file
– Nishant Saini
Jan 2 at 6:29
When you say
view source are you just saying that the source code for the html on your web page shows <h1>Alguém</h1>?– Joseph_J
Jan 2 at 6:32
When you say
view source are you just saying that the source code for the html on your web page shows <h1>Alguém</h1>?– Joseph_J
Jan 2 at 6:32
@Joseph_J yes, the
view-source:https://example.com should i worry about it?– Natalie
Jan 2 at 6:33
@Joseph_J yes, the
view-source:https://example.com should i worry about it?– Natalie
Jan 2 at 6:33
@NishantSaini tag missmatch? what do you mean?
– Natalie
Jan 2 at 6:35
@NishantSaini tag missmatch? what do you mean?
– Natalie
Jan 2 at 6:35
@Natalie Opening and closing php tags
– Nishant Saini
Jan 2 at 6:36
@Natalie Opening and closing php tags
– Nishant Saini
Jan 2 at 6:36
|
show 3 more comments
2 Answers
2
active
oldest
votes
Your code is working correctly. htmlentities converts html entities into a defined series of characters that your browser can interpret as the entity you want to display in your browser. This is done to prevent malicious code from being run in your script.
As an example:
Without html entities being used this line of code will actually work. Your browser sees the line of code as:
<script>alert("I just hacked your html")</script>
When you sanitize that same line of code with htmlentities() it replaces all of the entities with the defined series of character representations that the browser interprets as the entity. So this is what gets outputted to the browser.
<script>alert("I just hacked your html")<
This script will not get ran as javascript in your browser.
Here is a link that you can read that will give you some additional information. There is plenty of information on google that outlines this.
html entities
Here is a list of html entities:
Entity list
Hope that helps.
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
Whyhtmlentities()would replace words with accents (áàéèâêã...etc)?
– Natalie
Jan 2 at 6:54
Because they are defined character representations for those characters. This is done out of necessity due to the different encoding options(character sets) that are used. It's an attempt to standardize a wide variety of possible characters that might be used. I would do some reading on it,htmlentities()is doings it's job to help mitigate risk.
– Joseph_J
Jan 2 at 6:58
1
Food for thought: A lot of people runhtmlentities()or similar functions to thier data prior to moving the data to their database. I recommend not running these functions prior to your database options. If you properly use parameterized queries to query the database your raw data will sit in your database without issue. Then all you have to do is make sure you sanitize your data after you retrieve it from the database. This can easily be done in the function that retrieves that data. From that point on you don't have to worry about anything that is displayed to the user.
– Joseph_J
Jan 2 at 7:15
add a comment |
echo htmlentities($title, ENT_QUOTES);
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
1
There is no difference in the output between this and the OP code.
– Joseph_J
Jan 2 at 6:30
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54002001%2fechohtmlentities-is-not-working-propely%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Your code is working correctly. htmlentities converts html entities into a defined series of characters that your browser can interpret as the entity you want to display in your browser. This is done to prevent malicious code from being run in your script.
As an example:
Without html entities being used this line of code will actually work. Your browser sees the line of code as:
<script>alert("I just hacked your html")</script>
When you sanitize that same line of code with htmlentities() it replaces all of the entities with the defined series of character representations that the browser interprets as the entity. So this is what gets outputted to the browser.
<script>alert("I just hacked your html")<
This script will not get ran as javascript in your browser.
Here is a link that you can read that will give you some additional information. There is plenty of information on google that outlines this.
html entities
Here is a list of html entities:
Entity list
Hope that helps.
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
Whyhtmlentities()would replace words with accents (áàéèâêã...etc)?
– Natalie
Jan 2 at 6:54
Because they are defined character representations for those characters. This is done out of necessity due to the different encoding options(character sets) that are used. It's an attempt to standardize a wide variety of possible characters that might be used. I would do some reading on it,htmlentities()is doings it's job to help mitigate risk.
– Joseph_J
Jan 2 at 6:58
1
Food for thought: A lot of people runhtmlentities()or similar functions to thier data prior to moving the data to their database. I recommend not running these functions prior to your database options. If you properly use parameterized queries to query the database your raw data will sit in your database without issue. Then all you have to do is make sure you sanitize your data after you retrieve it from the database. This can easily be done in the function that retrieves that data. From that point on you don't have to worry about anything that is displayed to the user.
– Joseph_J
Jan 2 at 7:15
add a comment |
Your code is working correctly. htmlentities converts html entities into a defined series of characters that your browser can interpret as the entity you want to display in your browser. This is done to prevent malicious code from being run in your script.
As an example:
Without html entities being used this line of code will actually work. Your browser sees the line of code as:
<script>alert("I just hacked your html")</script>
When you sanitize that same line of code with htmlentities() it replaces all of the entities with the defined series of character representations that the browser interprets as the entity. So this is what gets outputted to the browser.
<script>alert("I just hacked your html")<
This script will not get ran as javascript in your browser.
Here is a link that you can read that will give you some additional information. There is plenty of information on google that outlines this.
html entities
Here is a list of html entities:
Entity list
Hope that helps.
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
Whyhtmlentities()would replace words with accents (áàéèâêã...etc)?
– Natalie
Jan 2 at 6:54
Because they are defined character representations for those characters. This is done out of necessity due to the different encoding options(character sets) that are used. It's an attempt to standardize a wide variety of possible characters that might be used. I would do some reading on it,htmlentities()is doings it's job to help mitigate risk.
– Joseph_J
Jan 2 at 6:58
1
Food for thought: A lot of people runhtmlentities()or similar functions to thier data prior to moving the data to their database. I recommend not running these functions prior to your database options. If you properly use parameterized queries to query the database your raw data will sit in your database without issue. Then all you have to do is make sure you sanitize your data after you retrieve it from the database. This can easily be done in the function that retrieves that data. From that point on you don't have to worry about anything that is displayed to the user.
– Joseph_J
Jan 2 at 7:15
add a comment |
Your code is working correctly. htmlentities converts html entities into a defined series of characters that your browser can interpret as the entity you want to display in your browser. This is done to prevent malicious code from being run in your script.
As an example:
Without html entities being used this line of code will actually work. Your browser sees the line of code as:
<script>alert("I just hacked your html")</script>
When you sanitize that same line of code with htmlentities() it replaces all of the entities with the defined series of character representations that the browser interprets as the entity. So this is what gets outputted to the browser.
<script>alert("I just hacked your html")<
This script will not get ran as javascript in your browser.
Here is a link that you can read that will give you some additional information. There is plenty of information on google that outlines this.
html entities
Here is a list of html entities:
Entity list
Hope that helps.
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
Your code is working correctly. htmlentities converts html entities into a defined series of characters that your browser can interpret as the entity you want to display in your browser. This is done to prevent malicious code from being run in your script.
As an example:
Without html entities being used this line of code will actually work. Your browser sees the line of code as:
<script>alert("I just hacked your html")</script>
When you sanitize that same line of code with htmlentities() it replaces all of the entities with the defined series of character representations that the browser interprets as the entity. So this is what gets outputted to the browser.
<script>alert("I just hacked your html")<
This script will not get ran as javascript in your browser.
Here is a link that you can read that will give you some additional information. There is plenty of information on google that outlines this.
html entities
Here is a list of html entities:
Entity list
Hope that helps.
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
answered Jan 2 at 6:42
Joseph_JJoseph_J
3,2732621
3,2732621
Whyhtmlentities()would replace words with accents (áàéèâêã...etc)?
– Natalie
Jan 2 at 6:54
Because they are defined character representations for those characters. This is done out of necessity due to the different encoding options(character sets) that are used. It's an attempt to standardize a wide variety of possible characters that might be used. I would do some reading on it,htmlentities()is doings it's job to help mitigate risk.
– Joseph_J
Jan 2 at 6:58
1
Food for thought: A lot of people runhtmlentities()or similar functions to thier data prior to moving the data to their database. I recommend not running these functions prior to your database options. If you properly use parameterized queries to query the database your raw data will sit in your database without issue. Then all you have to do is make sure you sanitize your data after you retrieve it from the database. This can easily be done in the function that retrieves that data. From that point on you don't have to worry about anything that is displayed to the user.
– Joseph_J
Jan 2 at 7:15
add a comment |
Whyhtmlentities()would replace words with accents (áàéèâêã...etc)?
– Natalie
Jan 2 at 6:54
Because they are defined character representations for those characters. This is done out of necessity due to the different encoding options(character sets) that are used. It's an attempt to standardize a wide variety of possible characters that might be used. I would do some reading on it,htmlentities()is doings it's job to help mitigate risk.
– Joseph_J
Jan 2 at 6:58
1
Food for thought: A lot of people runhtmlentities()or similar functions to thier data prior to moving the data to their database. I recommend not running these functions prior to your database options. If you properly use parameterized queries to query the database your raw data will sit in your database without issue. Then all you have to do is make sure you sanitize your data after you retrieve it from the database. This can easily be done in the function that retrieves that data. From that point on you don't have to worry about anything that is displayed to the user.
– Joseph_J
Jan 2 at 7:15
Why
htmlentities() would replace words with accents (áàéèâêã...etc)?– Natalie
Jan 2 at 6:54
Why
htmlentities() would replace words with accents (áàéèâêã...etc)?– Natalie
Jan 2 at 6:54
Because they are defined character representations for those characters. This is done out of necessity due to the different encoding options(character sets) that are used. It's an attempt to standardize a wide variety of possible characters that might be used. I would do some reading on it,
htmlentities() is doings it's job to help mitigate risk.– Joseph_J
Jan 2 at 6:58
Because they are defined character representations for those characters. This is done out of necessity due to the different encoding options(character sets) that are used. It's an attempt to standardize a wide variety of possible characters that might be used. I would do some reading on it,
htmlentities() is doings it's job to help mitigate risk.– Joseph_J
Jan 2 at 6:58
1
1
Food for thought: A lot of people run
htmlentities() or similar functions to thier data prior to moving the data to their database. I recommend not running these functions prior to your database options. If you properly use parameterized queries to query the database your raw data will sit in your database without issue. Then all you have to do is make sure you sanitize your data after you retrieve it from the database. This can easily be done in the function that retrieves that data. From that point on you don't have to worry about anything that is displayed to the user.– Joseph_J
Jan 2 at 7:15
Food for thought: A lot of people run
htmlentities() or similar functions to thier data prior to moving the data to their database. I recommend not running these functions prior to your database options. If you properly use parameterized queries to query the database your raw data will sit in your database without issue. Then all you have to do is make sure you sanitize your data after you retrieve it from the database. This can easily be done in the function that retrieves that data. From that point on you don't have to worry about anything that is displayed to the user.– Joseph_J
Jan 2 at 7:15
add a comment |
echo htmlentities($title, ENT_QUOTES);
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
1
There is no difference in the output between this and the OP code.
– Joseph_J
Jan 2 at 6:30
add a comment |
echo htmlentities($title, ENT_QUOTES);
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
1
There is no difference in the output between this and the OP code.
– Joseph_J
Jan 2 at 6:30
add a comment |
echo htmlentities($title, ENT_QUOTES);
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
echo htmlentities($title, ENT_QUOTES);
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
answered Jan 2 at 6:21
joslin selva cjoslin selva c
113
113
1
There is no difference in the output between this and the OP code.
– Joseph_J
Jan 2 at 6:30
add a comment |
1
There is no difference in the output between this and the OP code.
– Joseph_J
Jan 2 at 6:30
1
1
There is no difference in the output between this and the OP code.
– Joseph_J
Jan 2 at 6:30
There is no difference in the output between this and the OP code.
– Joseph_J
Jan 2 at 6:30
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54002001%2fechohtmlentities-is-not-working-propely%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Your example code works fine. Seems like there is some issue with the tag missmatch in php file
– Nishant Saini
Jan 2 at 6:29
When you say
view sourceare you just saying that the source code for the html on your web page shows<h1>Alguém</h1>?– Joseph_J
Jan 2 at 6:32
@Joseph_J yes, the
view-source:https://example.comshould i worry about it?– Natalie
Jan 2 at 6:33
@NishantSaini tag missmatch? what do you mean?
– Natalie
Jan 2 at 6:35
@Natalie Opening and closing php tags
– Nishant Saini
Jan 2 at 6:36