title: Preventing XSS from within HTML elements
body: <p>Is the following enough to prevent XSS from inside HTML elements?</p>
  
  <pre><code>function XSS_encode_html ( $str )
  {
      $str = str_replace ( '&amp;', "&amp;amp;", $str );
      $str = str_replace ( '&lt;', "&amp;lt;", $str );
      $str = str_replace ( '&gt;', "&amp;gt;", $str );
      $str = str_replace ( '"', " &amp;quot;", $str );
      $str = str_replace ( '\'', " &amp;#x27;", $str );
      $str = str_replace ( '/', "&amp;#x2F;", $str );
  
      return $str;
  }
  </code></pre>
  
  <p>As mentioned here: -<br>
  <a href="https://www.owasp.org/index.php/Abridged_XSS_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content" rel="nofollow">https://www.owasp.org/index.php/Abridged_XSS_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content</a></p>
  
  <p><hr>
  <strong>EDIT</strong></p>
  
  <p>I'm not using htmlspecialchars() because: -</p>
  
  <ol>
  <li>It does not change / to <code>&amp;#x2F;</code></li>
  <li>' (single quote) becomes '<code>&amp;#039;</code>' (or <code>&amp;apos;</code>) when ENT_QUOTES is set.</li>
  </ol>
  
  <p>According to OWASP, ' (single quote) should become <code>&amp;#x27;</code> (<em>call me pedantic</em>) and,<br>
  <code>&amp;apos;</code> not recommended because its not in the HTML spec</p>
  
  <hr>