Why doesn't htmlspecialchars work inside a function? [closed] - php

Question

Closed. This question is not reproducible or was caused by typos. It is not currently accepting answers.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Closed 9 years ago.
Improve this question
I have a very simple php script designed to test the function htmlspecialchars:
$question="<script>alert('hacked')</script>";
echo "<br>original question=",$question;
$question = make_secure( $question );
echo "<br>converted question=",$question;
echo "<br>converted question calling htmlspecialchars=",htmlspecialchars($question);
function make_secure($data) {
$data = htmlspecialchars($data); return $data; }
It should remove the special chars from the original string $question by calling a function with htmlspecialchars inside it. However, the function does not seem remove the special chars. They are only removed if I call htmlspecialchars explicitly in the script. Why?
Thanks.
EDIT: This is what I see when I run the script:
original question=
converted question=<script>alert('hacked')</script>
converted question calling htmlspecialchars=<script>alert('hacked')</script>
(the 'hacked' script is also executed first). To rephrase my question, why is the script still perfectly visible in $question on line line converted question= ? i.e. why hasn't the variable been converted? I thought that after the variable had been converted, the script should no longer be visible.

Answer 1

The output visible to the user should be:
(nothing, script executed)
<script>alert('hacked')</script>
<script>alert('hacked')</script>
The actual output, visible to the browser is:
<script>alert('hacked')</script>
<script>alert('hacked')</script>
&lt;script&gt;alert('hacked')&lt;/script&gt;
Which is exactly correct. The first line is unescaped, the HTML and script get interpreted. The second line is escaped once, displaying the text as is to the user. The third line is escaped twice, displaying the text as escaped once to the user.
You keep escaping the same variable over and over, so the result is going to change depending on how often you escape it. Maybe start here: The Great Escapism (Or: What You Need To Know To Work With Text Within Text)