Why this matters
Without escaping output, an attacker can inject malicious JavaScript (Cross‐Site Scripting) that will execute in other users’ browsers, compromising sensitive data and application integrity.
Always escape or sanitize user‐provided content before displaying it in HTML. Use functions like htmlspecialchars() to convert special characters into HTML entities.
Without escaping output, an attacker can inject malicious JavaScript (Cross‐Site Scripting) that will execute in other users’ browsers, compromising sensitive data and application integrity.
Side-by-side examples engineers can pattern-match during review.
<?php
echo "<p>Name: " . $_POST['nome'] . "</p>";
?><?php
$nome = htmlspecialchars($_POST['nome'], ENT_QUOTES, 'UTF-8');
echo "<p>Name: $nome</p>";
?><?php
echo "<p>Name: " . $_POST['nome'] . "</p>";
?><?php
$nome = htmlspecialchars($_POST['nome'], ENT_QUOTES, 'UTF-8');
echo "<p>Name: $nome</p>";
?>From the same buckets as this rule.