title: How to prevent cross site scripting
body: <p>I have the following form that users fill in:</p>
  
  <pre><code>&lt;form name="form" action="" method="POST"&gt;
      &lt;table width="100%" border="0"  cellpadding="2" cellspacing="2"&gt;
    &lt;tr&gt;
      &lt;td width="25%" &gt;&lt;div align="right"&gt;&lt;strong&gt;Name:&lt;/strong&gt;&lt;/div&gt;&lt;/td&gt;
      &lt;td width="75%" &gt;&lt;span id="sprytextfield1"&gt;
        &lt;input id="Cname"name="Name" type="text" placeholder="Please fill in your name"&gt;
        &lt;span class="textfieldRequiredMsg"&gt;A value is required.&lt;/span&gt;&lt;/span&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;div align="right"&gt;&lt;strong&gt;Email:&lt;/strong&gt;&lt;/div&gt;&lt;/td&gt;
      &lt;td&gt;&lt;span id="sprytextfield2"&gt;
      &lt;input id="Cemail"name="email" type="text" placeholder="e.g sales@company.co.uk"&gt;
      &lt;span class="textfieldRequiredMsg"&gt;A value is required.&lt;/span&gt;&lt;span class="textfieldInvalidFormatMsg"&gt;Invalid format.&lt;/span&gt;&lt;/span&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td&gt;&lt;div align="right"&gt;&lt;strong&gt;Phone Number:&lt;/strong&gt;&lt;/div&gt;&lt;/td&gt;
      &lt;td&gt;
      &lt;input id="Cphone" name="Phone" type="text"placeholder="e.g. 5555-6666666"&gt;
      &lt;/td&gt;
    &lt;/tr&gt; 
  
    &lt;tr&gt;
      &lt;td&gt;&amp;nbsp;&lt;/td&gt;
      &lt;td&gt;&lt;input name="Manufacturer" type="hidden" value="&lt;?php echo $row_emailProduct['Manufacturer']; ?&gt;"&gt;
      &lt;input name="Model" type="hidden" value="&lt;?php echo $row_emailProduct['Model']; ?&gt;"&gt;
      &lt;input name="Color" type="hidden" value="&lt;?php echo $row_emailProduct['Color']; ?&gt;"&gt;
      &lt;input name="price" type="hidden" value="&lt;?php echo $row_emailProduct['price']; ?&gt;"&gt;
      &lt;input name="id" type="hidden" value="&lt;?php echo htmlentities($_GET['id']); ?&gt;"&gt;
      &lt;input name="insert" id="insert" type="submit" value="Send Request"&gt;&lt;/td&gt;
    &lt;/tr&gt;&lt;/tr&gt;
  
  &lt;/table&gt;
           &lt;/form&gt;
  </code></pre>
  
  <p>Once the form is submitted the following happens:</p>
  
  <pre><code>if (isset($_POST["insert"])){
      $OK=false;
    $insertSQL = "INSERT INTO Item_intrest (Manufacturer, Model, Color, price, Name, Phone, email) VALUES (:Manufacturer, :Model, :Color, :price, :Name, :Phone, :email)";
  
  
    $Result1 = $conn-&gt;prepare($insertSQL) or die(errorInfo());
    $Result1-&gt;bindParam(':Manufacturer', htmlentities($_POST['Manufacturer']), PDO::PARAM_STR);
    $Result1-&gt;bindParam(':Model', htmlentities($_POST['Model']), PDO::PARAM_STR);
  $Result1-&gt;bindParam(':Color', htmlentities($_POST['Color']), PDO::PARAM_STR);
  $Result1-&gt;bindParam(':price', htmlentities($_POST['price']), PDO::PARAM_STR);
  $Result1-&gt;bindParam(':Name', htmlentities($_POST['Name']), PDO::PARAM_STR);
  $Result1-&gt;bindParam(':Phone', htmlentities($_POST['Phone']), PDO::PARAM_STR);
  $Result1-&gt;bindParam(':email', htmlentities($_POST['email']), PDO::PARAM_STR);
  $Result1-&gt;execute();
  $OK = $Result1-&gt;rowCount();
  
  
  
  /*email to shop */
  $emailsubject = 'Product Request';
  $webmaster = 'sales@company.co.uk';
  /*data collection */
  $Name = htmlentities($_POST['Name']);
  $email = htmlentities($_POST['email']);
  $Phone = htmlentities($_POST['Phone']);
  $item1 = htmlentities($_POST['Manufacturer']);
  $item2 = htmlentities($_POST['Model']);
  $item3 = htmlentities($_POST['Color']);
  $Price = htmlentities($_POST['price']);
  
  $Body = &lt;&lt;&lt;EOD
  &lt;br&gt;&lt;hr&gt;&lt;br&gt;
  Name: $Name&lt;br&gt;
  Email: $email&lt;br&gt;
  Phone: $Phone&lt;br&gt;
  Product:$item1, $item2,$item3&lt;br&gt;
  Price: $Price&lt;br&gt;
  EOD;
      $headers = "From: $email\r\n";
      $headers .= "content-type: text/html\r\n";
      $succes = mail($webmaster, $emailsubject, $Body, $headers);
  
  
  if($OK){
    header('Location: /thankyourequest.php?id=' . htmlentities($_GET['id']). '');
    exit;
  }else {
      $errorInfo = $Result1-&gt;errorInfo();
      if(isset($errorInfo[2])){
          $error = $errorInfo[2];
          }
  }
  }
  </code></pre>
  
  <p>For some reason when it is scan it returns </p>
  
  <pre><code>From: &amp;lt [mailto:&amp;lt] 
  Sent: 20 April 2015 10:04
  To: sales@company.co.uk
  Subject: Product Request
  
  
  
  Name: &lt;script&gt;alert("xssvuln")&lt;/script&gt;
  Email: &lt;script&gt;alert("xssvuln")&lt;/script&gt;
  Phone: &lt;script&gt;alert("xssvuln")&lt;/script&gt;
  Product:&lt;script&gt;alert("xssvuln")&lt;/script&gt;, &lt;script&gt;alert("xssvuln")&lt;/script&gt;,&lt;script&gt;alert("xssvuln")&lt;/script&gt;
  Price: &lt;script&gt;alert("xssvuln")&lt;/script&gt;
  </code></pre>
  
  <p>As you can see I've tried to prevent this with htmlentities how ever that does not seem to be enough.
  Any help welcome to prevent this</p>