PHP lesson 21: Safe input: htmlspecialchars() and checking
US version. US grades and US spelling. · UK version of this lesson
Anything a visitor sends could be harmful. If someone types <script> into a form and your page prints it raw, their code runs on other people's screens. This attack is called cross-site scripting (XSS). A complete 40-minute PHP lesson (Grades 9–12), from Unit 7: PHP and the web. It runs right here in your browser – nothing to install.
- Time
- 40 minutes + 20 min homework
- Grade
- Grades 9–12 (ages 14–18)
- You need
- A computer or tablet, paper and a pencil
- Graded
- Instantly, with explanations
For parents: how to use this lesson
You don't need to know PHP yourself. The lesson explains each step on screen, the way Mr Babbage, our Head of Computing, likes it: a worked example first, then a go for your child. Your child predicts what code prints, traces it and puts it in order – graded straight away – and then writes and fixes real PHP in the practice test, where it runs in the browser.
- Read what your child will learn together.
- Press Start the lesson below. Sit with your child for the teaching and the worked example (about 16 minutes): ask them to say what each line does.
- Let them do the practice on their own, then the write-it and fix-it questions in the practice test. When code goes wrong, PHP's message is a clue – let them read it out and try again before you help.
- Finish with the talk question: Explain to a younger learner why a website should not trust what visitors type.
Watch out for
- Only bad people type
<. Anyone can; treat all input as unsafe. htmlspecialchars()deletes the tags. It keeps them as visible text, like <b>.
Miss Lovelace's tip for home: ask your child to explain one line of their program to you in their own words. If they can explain it, they understand it – and every message from PHP is a clue, not a failure.
What your child will learn
Learning goal: explain why visitor input must never be printed raw.
Success looks like
- I can explain why visitor input must never be printed raw.
- I can use
htmlspecialchars()before printing input. - I can check input with
is_numeric(),trim()andstrlen().
Key words
security · cross-site scripting (XSS) · escaping · htmlspecialchars · validation · sanitising
What to have ready
- A device with a web browser (PHP runs in the browser – nothing to install)
- Paper for tracing
- A keyboard helps for typing code (a tablet or phone works too)
The big ideas (for the adult)
Anything a visitor sends could be harmful. If someone types <script> into a form and your page prints it raw, their code runs on other people's screens. This attack is called cross-site scripting (XSS).
htmlspecialchars() turns < into <, > into >, & into & and quote marks into codes, so the browser SHOWS the characters instead of running them. Use it on every value you print that came from a visitor.
Check input before you trust it: trim() it, test strlen() for sensible lengths, and use is_numeric() before treating it as a number. Show a helpful message when the input is not right.
Worked example – see it
<?php
echo htmlspecialchars("<b>Eli</b>");It prints:
<b>Eli</b>
The lesson, step by step
| Part | Time | How it is checked |
|---|---|---|
| Starter | 5 min | Graded by Classfern |
| Teaching input | 8 min | Read, watch and talk |
| See it, then predict | 8 min | Graded by Classfern |
| Put it in order, trace it, check it | 14 min | Graded by Classfern |
| Closure and exit ticket | 5 min | Graded by Classfern + self-check |
The lesson
It runs here on the page. No sign-up and no names – progress is kept only in this browser. Each visit picks a new mix of questions.
Homework
20 minutes: 5 questions – predict what code prints, trace it or put it in order, and check the key ideas – then a short reflection. New questions every time, all graded instantly.
Write it and fix it: practice tests
The practice tests run real PHP in your browser: write and fix short programs, graded against hidden tests.
Curriculum
CSTA K–12 Computer Science Standards (2017): 3B-AP-18 – Explain security issues that could compromise programs; 3B-AP-21 – Develop and use test cases to check a program meets its specification.
The standard codes are CSTA's; the descriptions are our own words.
Our lessons and questions are our own. They are not written or endorsed by any government department, testing agency or exam board. Classfern is not affiliated with or endorsed by The PHP Group. PHP runs here as php-wasm, under its open-source licences.