This depends on the context. I am assuming you're using
htmlentities() function, which would be generally safe. It does more or less the exact same thing as
Both of which secure against general XSS, and prevent event-based XSS when the sanitized parameter is injected into a HTML tag.
They both do not prevent
href from any of them tags, I would recommend first removing any whitespace from the parameter, and then checking for both
data:text/html:<script>alert(0);</script> does the same thing too, and bypasses
The reason for first removing whitespace, is to prevent an attacker dropping a line break/CRLF character in the middle of their payload, so PHP reads it as not being
I hope that explains what type of attacks are possible, it's very easy to claim that
htmlspecialchars() are a one-fits-all solution to the problem, but depending on the situation, that can be extremely dangerous advice.