MyBB Community Forums

Does MyBB have a built in function to prevent XSS problems when echoing? Or should I just use:

echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

(2017-02-17, 02:29 AM)Achilles Wrote: [ -> ]Does MyBB have a built in function to prevent XSS problems when echoing? Or should I just use:

echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

When echoing a variable use:

echo htmlspecialchars($string);

You shouldn't need anything else

The custom function htmlspecialchars_uni() is used throughout MyBB.

(2017-02-17, 06:19 AM)Nathan Malcolm Wrote: [ -> ]The custom function htmlspecialchars_uni() is used throughout MyBB.

I was looking this up, that will allow for unicode while standard htmlspecialchars is UTF-8 or UTF-16 (I think). Can anyone tell me what the advantage is for unicode? Haven't found a simple answer besides the fact that unicode creates a unique symbol for every character.

This thread has a pretty descriptive answer. I believe though the tl;dr is that it's essentially so that your board can display multiple languages more accurately/easily, if anyone knows more though feel free to correct me.