Anti-XSS

You have a succesfull website but you are afraid of hackers who are going to kill your work ? Prevent it ! One of the most common attack type is XSS. If you can stop that you are already pretty secured against most hackers who try to login into your name.

XSS
XSS is Cross-Site-Scripting and allows the hacker to insert client side codes like javascript or html. After they have found an XSS leak they can easily steal your cookies and login on your account.

Prevention ? Easily ! PHP has a function called htmlspecialchars. This function will replace some html tags into their special significance. This prevents the code to execute as a normal html code !

Example:

<?php
    $text = '<script>alert(1);</script>';
        echo htmlspecialchars($text); //Will just print out <script>alert(1);</alert>
        echo $text; //Will execute <script>alert(1);</alert>
?>

Output:
<script>alert(1);</script>
<script>alert(1);</script>

So when you have something were people can do a input trough (url, form) put before the command htmlspecialchars() so it can't be executed !