Escaping photo caption to avoid cross site script attack
Instead of a one size fits all approach, you can filter things based on what they are.


URLs and url parameters can be encoded with urlencode()
Output inside of html tags can be filtered with strip_tags()
Other more general output that you are using with HTML attributes such as 'alt' are less predictable, and can be filtered with htmlentities()