Using htmlspecialchars when not outputting to html

Question

For example if i use $id= $_GET['id']; and then i use that $id as a condition for an if statement, do i have to use htmlspecialchars on $id?

e.g.

$id = htmlspecialchars($_GET['id']);

if($id) {
//code
}

Is htmlspecialchars needed, even though no html is being output?

deceze · Accepted Answer · 2012-07-03 09:20:26Z

3

No. You only need to HTML-escape data if you are outputting it into an HTML context, and the data may contain characters which have a special meaning in HTML (e.g. <, >, ") and you do not want those characters to break your HTML structure.

Also see The Great Escapism (Or: What You Need To Know To Work With Text Within Text).

answered Jul 3, 2012 at 9:20

deceze♦

525k89 gold badges806 silver badges954 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Using htmlspecialchars when not outputting to html

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related