I am upgrading the security of an existing site (so can't redo everything with a framework that has xss functions built in), so I am looking for a way to protect against XSS attacks such as the ones listed by OWASP here.
At the moment I use
htmlspecialchars($text, ENT_QUOTES, 'UTF-8'); for output into HTML,
json_encode for JS and HTMLPurifier for data containing HTML tags but am concerned this is not enough/correct. I am looking for a function that I can use like:
<div><?php echo escape_for_html($text); ?></div> <img src="<?php echo escape_for_attribute($text); ?>">