title: How to prevent XSS in my site?
body: <p>I believe I read all the related threads appeared to me when I was writing the title.</p>
  
  <p>In short, I have used almost ALL the PHP functions to sanitize the user's input, yet I still fail to stop a simple XSS test to be executed.</p>
  
  <p>The code which I'm trying to secure is as follows:</p>
  
  <pre><code>    $keyword = $_POST['biz'];
      $keyword = strip_tags($keyword); //this
  $keyword = addslashes(str_replace("||sp_rp_and||", "&amp;", $keyword));
  $keyword = addslashes(str_replace("&lt;", "HELLO", $keyword)); //this
  
  $myFilter = new InputFilter(); //this
  $keyword = $myFilter-&gt;process($_POST['biz']); //this
  if($keyword=="")
  $query="select * from `business` order by business_id DESC LIMIT 0,20";
  else
  </code></pre>
  
  <p>However, non of the functions does what it is supposed to do on the variable <strong>$keyword</strong></p>
  
  <p>Two possibilities:
  *I have no what I'm doing.
  *The XSS test fails, yet it doesn't mean that a person can use it to harm !!?</p>
  
  <p>The test I used is simple (in the search field of th page): `">alert(document.cookie);" 
  or through the URL, same result in both, a popup with the cookie shows.</p>
  
  <p>What Am I doing wrong, been into this since couple of days.</p>
  
  <p>P.S. Even installed Mod_security2 on server and it didn't do the job ( Or I didn't configure properly) !!</p>