Should I use both striptags() and htmlspecialchars() to prevent XSS?

Question

Does this depend on if the input is going to be printed to the user? In my case I need to return the input back to the user (comments and bio).

Thanks!!!

Answer 1

htmlspecialchars() is enough to prevent XSS.

Strip tags removes tags but not special characters like " or ', so if you use strip_tags() you also have to use htmlspecialchars().

If you want users' comments to be displayed like they typed them, don't use strip_tags, use htmlspecialchars() only.