Minimum HTML Screening Requirements

Question

What are the required and sufficient characters when exiting user content before exiting? (in other words: what are the characters that web developers should avoid when displaying text that was previously received from an unreliable anonymous source?)

Answer 1

When you repeat the page you need to encode

• '&' (ampersand) becomes ' &'
• '' '(double quote) becomes' "'
• '' '(single quote) becomes' ''
• '<' (less) becomes ' <'
• ' > ' () '>'

PHP htmlspecialchars() docs.

, .

.

Answer 2

, < > & " ' .