title: How to protect a website from xss (Cross site scripting)
body: <p>Ok so i've  learned a bit of PHP and tried making a simple application but i am not sure is my webpage secure from xss and other such attacks .</p>
  
  <p>My PHP CODE </p>
  
  <pre><code>&lt;?php 
  $title=$keywords=$description="";
  $valid_er="";
  
  
  if($_SERVER["REQUEST_METHOD"] == "POST"){
  
  if(empty($_POST['title'])){
  
  $valid_er="has-error";
  }
  
  else{
  $title="&amp;lt;title&amp;gt;".test($_POST["title"])."&amp;lt;title&amp;gt;";
  }
  
  
  $keywords='&amp;lt;meta name="keywords" content="'.test($_POST["keywords"]).'" /&amp;gt;';
  $description='&amp;lt;meta name="description" content="'.test($_POST['description']).'" /&amp;gt;';
  
  }
  
  function test($ci){
  
  $ci=htmlentities($ci);
  $ci=stripcslashes($ci);
  return $ci;
  }
  
  
  ?&gt;
  </code></pre>
  
  <p>And MY HTML FORM</p>
  
  <pre><code>&lt;form method='post' class='form-group' action="&lt;?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?&gt;"&gt;
  &lt;label&gt; Your Title  &lt;/label&gt; &lt;input placeholder="Your websites title" type="text" name="title" class='form-control' class='form-group-item'/&gt;&lt;/br&gt;
  &lt;label&gt; Keywords &lt;/label&gt; &lt;input placeholder="Your keywords separated by comma " type="text" name="keywords" class='form-control' class='form-group-item'/&gt;&lt;/br&gt;
  &lt;label&gt;Description &lt;/label&gt; &lt;textarea  placeholder="A nice description about your website;" name="description" class='form-control'&gt;&lt;/textarea&gt;&lt;/br&gt;
  &lt;input type="submit" class='btn btn-info'&gt;
  
      &lt;/form&gt;
  </code></pre>
  
  <p>I just wanted to know am i vulnerable to cross site scripting , because i don't think only using </p>
  
  <blockquote>
    <p>htmlspecialchars()</p>
  </blockquote>
  
  <p>will protect me .</p>