im building a small forum and got this problem that when i post a comment on it. That have <
inside it then htmlspecialchars is converting it to >
. link to forum (it's danish but your should be able to use it).
If you want to allow special characters in the comments (which, in my opinion, is the right thing to do for a general field like "Comments"), then you should only worry about special characters when the field contents are written into some potentially "dangerous" context: SQL code, HTML, JavaScript, or even log files. Each of those contexts has its own hazards, so "quoting" varies from one to the next.
If you apply the special characters filtering for HTML when you want to show the comments to the user, then that conversion of "<" to >
is exactly what you want. When the browser parses the comment text as part of your HTML page, the >
will be transformed into the "<" glyph on the screen.
If you perform the transformation when you read the comment and when you write it, you'll end up with a double-encoding bug: the "&" character in >
will itself be transformed into &
. The browser will therefore see the string &gt;
which will cause it to show >
on the screen instead.