提取数据和XSS

Question

I am currently extracting data from a RSS feed (XML). An example would be:

Bob's dog

Now I have a problem: I would like to protect myself against XSS due to the data coming from a foreign source. Therefore, I go ahead and escape the data, result:

Bob's dog

Now when I'm trying to print the data I extracted, it prints:

Bob's dog

... instead of ...

Bob's dog

Question: How can I protect myself against XSS but still print the data by avoiding double-entities?

Answer 1

First you want to decode the string using either html_entity_decode() or htmlspecialchars_decode() . And after that re-encode the string to prevent XSS using:

htmlspecialchars($theString, ENT_QUOTES, 'UTF-8'); // or whatever encoding

Although the data already looks like it is encoded we re-encode it either way, because the 3rd party at some point can decide at some point to start using raw data instead.

This way you would still be protected.