How to filter incoming data?

Question

PHP

How to filter incoming data?
1. use PDO + Prepare Statements - I use it,
but then what?
when to use htmlentities and when htmlspecialchars?
Please do not offer ready-made template engines. I'm learning and trying to understand and understand what, how and why ..

Answer 1

when to use htmlentities and when htmlspecialchars?

Never. Template engines will figure it out themselves (they have their own htmlspecialchars inside)

Please do not offer ready-made template engines. I'm learning and trying to understand and understand what, how and why ..

When learning, it is customary to first try what is ready, and then use your own, if necessary.
If you do everything topsy-turvy (your own before the right one), then your training will be delayed 10 times.

Answer 2

Further here:
php.net/manual/en/function.htmlentities.php
php.net/manual/ru/function.htmlspecialchars.php

Answer 3

To begin with, I propose to clarify the meaning of the word filter by highlighting the following options for processing user data.
To fulfill the first two points in php there is an extension Filter , which deals with validation and cleaning of input data.
The third point says that if the data received from the user is substituted somewhere, then they must be correctly formatted. Moreover, this must be done directly at the time of substitution (writing to the database or output to html).
When outputting data to html (unless you explicitly allow html tags to be output), all special characters (quotes, greater than and less than signs, ampersand) must be converted to HTML entities. This is exactly what the htmlspecialchars function does . Htmlentities translates not only these characters, but also many others (the exact list can be obtained with the get_html_translation_table function). If you use utf-8 on the site, then you don't need it at all.
Now about what you should pay attention to when using htmlspecialchars :
Final use case for htmlspecialchars:
I also advise you to look at the documentation for the Zend\Escaper library , which contains examples of correct and incorrect data formatting when outputting to various parts of an html document.