Why is this design not allowed?

Question

PHP

Good time of the day. On Habré I read that such a construction is unacceptable. Why and how to do it right? I understand it's just not safe. XSS?

<?php
$name = $_GET['name'];
echo "Hello, <b>$name</b>!";
?>

Answer 1

well, yes, it would be necessary to run it through strip_tags/htmlentities at least during the output. You need to filter not only user input, but also the output of user data. Users, you know, can't be trusted.