Escaping Output the Boring, Correct Way

Cross-site scripting bugs are almost always a story about forgetting one call to htmlspecialchars(). The fix is unglamorous: wrap every piece of user-controlled or database-sourced text before it touches HTML.

A tiny helper pays for itself

Define e($value) once in your functions file and use it everywhere a variable lands in a template. It is two lines of code and it eliminates an entire bug class.

function e($value) {
    return htmlspecialchars((string) $value, ENT_QUOTES, "UTF-8");
}

Pair it with a strict Content-Security-Policy header and you have removed most of the attack surface a blog like this one would otherwise have.