Input security for post PHP [duplicate] - php

Question

This question already has an answer here:
Should I use both striptags() and htmlspecialchars() to prevent XSS?
(1 answer)
Closed 7 years ago.
I´ve a doubt about SECURITY linked to POST data in PHP.
The context:
I´ve several input (text, email, radio) and some textarea.
EG
<input type="text" name="entries[]"> /* Input ARRAY */
<input type="text" name="username">
<textarea name="message[]">...</textarea> /* Textarea ARRAY */
What I´m doing is sending all the values to the *.php page and then, I print all of them
EG
if($_POST)
{
$entries = htmlspecialchars("$_POST['entries']", ENT_QUOTES);
$username = htmlspecialchars("$_POST['username']", ENT_QUOTES);
$message = htmlspecialchars("$_POST['message']", ENT_QUOTES);
echo $username;
echo...
echo...
}
I do not know too much about security. Is it ok JUST with htmlspecialchars...?
Or Have I to use other functions?
The data is JUST to print with echo on the *.php page (no MYSQL)
And yes, my doubt is about the cide that the user can put on each INPUT, because I don´t want to limitate their contents just to text or numbers, or similar.
Thanks.

Answer 1

You need to loop over the arrays.
$entries = array_map('htmlentities', $_POST['entries']);
$username = htmlentities($_POST['username']);
$message = array_map('htmlentities', $_POST['message']);
or to include ENT_QUOTES you can use:
$entries = array_map(function($x) {
return htmlentities($x, ENT_QUOTES);
}, $_POST['entries']);
and similarly for $message.