title: Should I use htmlentities() on all output? (preventing XSS attacks)
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/71328/what-are-the-best-practices-for-avoiding-xss-attacks-in-a-php-site">What are the best practices for avoiding xss attacks in a PHP site</a><br>
    <a href="https://stackoverflow.com/questions/3129899/what-are-the-common-defenses-against-xss">What are the common defenses against XSS?</a>  </p>
  </blockquote>
  
  
  
  <p>I'm trying to make a PHP application I've written secure and have a question about escaping output. I switched to using prepared statements with PDO once I learned doing so would prevent SQL injections, and it seems that the other main type of attack is XSS. I build the output for my pages like this (assume the variables have data from the database in them):</p>
  
  <pre><code>$output = '';
  
  $output .= '
  &lt;div style="float: left; width: 800px;"&gt;
      &lt;span&gt;Name:&lt;/span&gt;&lt;span&gt; ' . $name . '&lt;/span&gt;
      &lt;span&gt;Address:&lt;/span&gt;&lt;span&gt;' . $addr . '&lt;/span&gt;
      &lt;span&gt;Time:&lt;/span&gt;&lt;span&gt;' . time() . '&lt;/span&gt;
  &lt;/div&gt;';
  
  $output .='[lots more html]';
  </code></pre>
  
  <p>So, my question is, should I use <code>htmlentities()</code> around every piece of data from the database being output (a typical page has dozens, some possibly hundreds, of variables from the database being output)?</p>