Server-Side Input Sanitization for XSS Prevention in PHP

<?php

/**
 * Sanitizes a string for safe display in HTML to prevent XSS attacks.
 * Converts special characters (&, ", ', <, >) to their HTML entities.
 *
 * @param string $input The string to sanitize.
 * @return string The sanitized string.
 */
function sanitizeForHtmlDisplay(string $input): string
{
    // ENT_QUOTES also converts single quotes, which is often crucial.
    // 'UTF-8' ensures correct handling of various character sets.
    return htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8');
}

/**
 * An example function simulating saving user input (e.g., a comment).
 * In a real application, you'd store the raw input in a database.
 * Sanitization should primarily happen *before displaying* the data.
 */
function saveUserInput(string $comment): string
{
    // For storage, often the raw data is preferred, and sanitation happens on output.
    // However, if strict data integrity is needed, some pre-storage validation/sanitization can occur.
    // For demonstration, we'll return the "saved" raw comment.
    return $comment;
}

// --- Usage Example ---

// Scenario 1: Malicious user input
$maliciousInput = "<script>alert('XSS Attack!');</script><h1>Malicious Content</h1>";
echo "<h2>Original (Malicious) Input:</h2>
";
echo $maliciousInput . "
";

// Save the raw input (or after minimal validation)
$storedComment = saveUserInput($maliciousInput);

echo "<h2>Attempting to display stored (raw) comment without sanitization:</h2>
";
// This would execute the script if rendered in a browser without proper headers
// echo $storedComment . "
"; // DO NOT DO THIS IN PRODUCTION!
echo "<textarea style='width:100%; height:80px;'>{$storedComment}</textarea>
";

echo "<h2>Displaying stored comment AFTER sanitization:</h2>
";
$safeComment = sanitizeForHtmlDisplay($storedComment);
echo $safeComment . "
";
echo "<textarea style='width:100%; height:80px;'>{$safeComment}</textarea>
";

echo "
";

// Scenario 2: Benign user input
$benignInput = "Hello & Welcome to my site! It's great to see you.";
echo "<h2>Original (Benign) Input:</h2>
";
echo $benignInput . "
";

$storedBenignComment = saveUserInput($benignInput);

echo "<h2>Displaying stored benign comment AFTER sanitization:</h2>
";
$safeBenignComment = sanitizeForHtmlDisplay($storedBenignComment);
echo $safeBenignComment . "
";

?>