I have simple PHP code for checking IP:
<?php $ip = $_SERVER['REMOTE_ADDR'];
echo ("<h1><b>Your IP:</b> $ip<h1>");
If I use
htmlentities, then my html doesn't work.
What is the best way to protect it against XSS?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Use htmlentities just on the user-supplied data:
<?php $ip = $_SERVER['REMOTE_ADDR']; $escaped_ip = htmlentities($ip); echo ("<h1><b>Your IP:</b> $escaped_ip<h1>");
If you are writing a real application, it would be better to use some template language that escapes values by default. This makes it easier for the developer to do it correctly, making it more secure.