Fixing XSS in Legacy Templates

Legacy templates often echo $row['name'] directly. Introduce an e() helper using htmlspecialchars(..., ENT_QUOTES, 'UTF-8'), replace raw echoes systematically (search for <?= $ and echo $), and consider moving templates to Twig, which auto-escapes. Add a Content Security Policy to reduce impact while the migration proceeds.

<?php
function e($value): string
{
    return htmlspecialchars((string) $value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
?>
<!-- Before -->
<td><?php echo $row['comment']; ?></td>
<!-- After -->
<td><?= e($row['comment']) ?></td>

Common pitfalls

• Escaping only some fields because they 'can't contain HTML'.
• Double-escaping data that was escaped on input.
• Forgetting attribute contexts (value="<?= $x ?>").

Key points

• One escaping helper, used everywhere
• Search for raw echoes systematically
• Twig auto-escapes; CSP limits damage

Further reading: OWASP XSS Prevention Cheat Sheet