title: use of htmlspecialchars()
body: <p>I am learning php and I came across htmlspecialchars() that it is used to prevent hackers attack , How ? I have read it on google , did not understand yet.Can you please give an example how ?</p>
  
  <pre><code>&lt;form method="post" action="&lt;?php echo htmlspecialchars($_SERVER['PHP_SELF']);?&gt;"&gt;
  Website : &lt;input type="text" name="website"&gt;&lt;br&gt;
  &lt;input type="submit" value="Submit" name="button"&gt;
  
  &lt;/form&gt;
  
  &lt;?php 
  if($_SERVER["REQUEST_METHOD"] == "POST"){
      $website = $_POST['website'];
      echo "true";
  if(empty($website)){
  
      echo  "empty";
      }
  else{
      echo $website;
      }
  }
  ?&gt;    
  </code></pre>
  
  <p>when I enter a url like this <code>http://www.example.com/test_form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E</code> the output is 
  <code>http://www.example.com/test_form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E</code></p>
  
  <p><br>when I remove the <code>htmlspecialchars()</code> 
  from 
  <code>&lt;form method="post" action="&lt;?php echo htmlspecialchars($_SERVER['PHP_SELF']);?&gt;"&gt;</code> 
  the output is same . Why ? what is the use of <code>htmlspecialchars()</code> then ??
  <br><br>and 
  However, consider that a user enters the following URL in the address bar:</p>
  
  <p><code>http://www.example.com/test_form.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E</code></p>
  
  <p><br>In this case, the above code will be translated to: (how and where this happens ?)</p>
  
  <p><code>&lt;form method="post" action="test_form.php/"&gt;&lt;script&gt;alert('hacked')&lt;/script&gt;</code></p>