First, you’re comparing a HTML 4.01 specification with an HTML 5 one. HTML5 ties more closely in with XML than HTML 4.01 ever does (that’s why we have XHTML), so this answer will stick to HTML 5 and XML. Your quoted references are all consistent on the following points: < should always be represented with … Read more
After much banging-head-on-table, I have a bit better understanding of the issue that I wanted to post for anyone else who may have had this issue. While the UTF-8 character set will display special characters on the client, the server, on the other hand, may not be so accomodating and would print special characters such … Read more
I started wondering what behavior these constants have when I saw these constants at the htmlspecialchars page. The documentation was rubbish, so I started digging in the source code of PHP. Basically, these constants affect whether certain entities are encoded or not (or decoded for html_entity_decode). The most obvious effect is whether the apostrophe (‘) … Read more
Your confusion is quite common because information and examples in books and on the internet including php.net are misleading or ambiguous. The most important thing you can learn when developing web apps is filter input, escape output. Filter Input This means that for any data input whether provided by a user on a form or … Read more
You should only call this method when echoing the data into HTML. Don’t store escaped HTML in your database; it will just make queries more annoying. The database should store your actual data, not its HTML representation.