php - Is this much escaping necessary?

Yes, it's necessary. See Wikipedia for information on cross-site scripting vulnerabilities.

The threat here is XSS. It's Javascript code that an attacker would try to execute using an XSS attack.

To see for yourself, remove the htmlspecialchars() then post this asname:

<script>alert('xss')</script>
Copy code

You'll see that your PHP code will print that out and the browser will execute the Javascript. The most common XSS attacks are on web applications where a user has a logged in session. A successfull XSS attack could read the victim's session ID cookie usingdocument.cookie and then send it to the attackers website where the attacker could proceed with a session hijack.

This attack is known as a Reflective XSS. A more severe type of XSS is a Persistent XSS which is where you store the input to a database for example, then you print it out on your homepage for all users to see, or any other page. A persistent XSS is much more harmful because any visitor of the page where the XSS persists can be attacked without actually having to re-launch the attack for each victim.

Solution:

If you are only going to print what that same users posts, they cannot do much harm to you or other users. However, it is useful nevertheless as user might use ">" and "<" and they would ruin the representation of the content.

However, if you are going to show the content which other users submit, this becomes much more dangerous.

User can inject anything from links to other sites to javascript.

<script>window.location = 'http://www.evilsite.com';</script>
Copy code

And all users who come to the site which displays this bit of user submitted content will be redirected to evilsite.

Solution:

Yeah, someone could for example inject some Javascript code, which when displayed would for example redirect them to another site (which is fairly harmless).

example:

<script type="text/javascript">
window.location = "http://www.google.com/"
</script>
Copy code

Would redirect the user to google if it were to be posted without being escaped

Solution:

PHP code cannot be injected into that field as it is not evaluated by the PHP interpreter, however it does introduce the potential for cross site scripting.

You can test this by using something like this:

<form action="" method="POST">
<input type="text" name="name"/>
<input type="submit"/>
</form>

<?php
if(isset($_POST['name'])){?>
    Hi <?php echo htmlspecialchars($_POST['name']); ?>.
<?php}?>
Copy code

Then in the "name" field, submit this code and see what happens:

<script type="text/javascript">alert("P0WN3D");</script>
Copy code

Solution:

Can someone actually put in malious code into that one line?
Yes.