Would this XSS protection work?

Question

PHP

Good afternoon! I came across an article where the author gives such a function

function defender_xss($arr){
   $filter = array("<", ">","="," (",")",";","/");
     foreach($arr as $num=>$xss){
        $arr[$num]=str_replace ($filter, "|", $xss);
     }
       return $arr;
} 
//используйте  функцию перед обработкой входящих данных:
$_REQUEST=defender_xss($_REQUEST);

also writes that a piece

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

inserted into htaccess will also give a plus.
The question is this. Will such protection work normally? If so, is it necessary to use htaccess, or will it be enough to pass data through a php function and that's it? What jambs can get out when using this function?

Answer 1

array("<", ">","="," (",")",";","/") - but what if you really have text with quotes and brackets at the input?
And it is better to do the filtering itself before displaying it on the page, so that the actual data is stored in the database.

Answer 2

www.php.net/manual/ru/function.htmlspecialchars.php
// upd
XSS protection occurs only at the time of rendering the data.

Answer 3

@Hakkunamatata @Miraage i.e. it turns out that everything can be written to the database calmly, checked only for SQL injections, and already when outputting, in order to avoid misunderstandings, put htmlspecialchars? and it will save from XSS?

Answer 4

The approach is absolutely correct. The reason for XSS and SQL Inj is the lack of user data filtering.
The given example of filtering will help only from elementary attacks, because. you can transfer data using special characters and entities.
I personally prefer to build protection based on whitelisting and escaping.