Escaping photo caption to avoid cross site script attack I am a PHP newbie and this is part of a gallery code. I recently read about SQL injection and cross site scripting attack, I am trying to avoid that by html escaping on dynamically produced data. I am not sure if I am heading in the right direction here. I created an array with URL parameters then a function for HTML escaping. Can you critique this code and let me know what I am doing wrong?

$parameters_new = array('name' =&gt; $name,'pcaption' =&gt; $caption_array[$new]);

function html_escape($input, $encoding)
{
    return htmlentities($input, ENT_QUOTES, $encoding);
}

$result_final .= '&lt;div class="limage"&gt;&lt;table&gt;&lt;tr&gt;&lt;td&gt;&lt;table class="image"&gt;&lt;tr&gt;&lt;td&gt;&lt;a href="' . html_escape('gallery.php?' . http_build_query($parameters_new), 'UTF-8') . '"&gt;
&lt;img src="'. $img_dir . '/' .$photo_filename.'"  alt=" ' . $photo_keywords . '"&gt;&lt;/a&gt;
&lt;div class="caption"&gt;'.$photo_caption.'&lt;/div&gt;&lt;div class="excerpt"&gt;'.$photo_description.'&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;div class="underline"&gt;&lt;/div&gt;;
Instead of a one size fits all approach, you can filter things based on what they are.


URLs and url parameters can be encoded with urlencode()
Output inside of html tags can be filtered with strip_tags()
Other more general output that you are using with HTML attributes such as 'alt' are less predictable, and can be filtered with htmlentities()