php - MySQL how to properly deal with rows containing code/cross-site-scripting? -

assuming parse logfile has been submitted user , store parsed data in mysql database.

now if user mean enough submit logfile contains line similiar nickname=<script>alert(hello);<script>. parser grab behind equals sign , execute insert nicknames (name) value ('<script>alert(hello);</script>').

i have tried around bit , figured mysqli_real_escape_string() preventing line in logfile such nickname=' , 1 = 2 breaking query escaping '. assumed deal <script>/</> , other codes/characters, apparently wrong.

in case mentioned above, when user submits logfile containing line nickname=<script>alert(hello);<script>, nicknames.name column hold value <script>alert(hello);<script>.

later values read table , displayed, 1 nickname per row in <table> on website. ofcourse won't display "nickname" in case; cross-site-script being executed. instead of table row containing nickname message box pops saying 'hello'.

is there common way prevent cross-site-scripting function similiar mysqli_real_escape_string()? proper solution problem, or maybe best?

ofcourse strip off < , > before inserting column, prefer way display nickname <script> tag in it, in table.

regards

you can use htmlspecialchars convert html tags syntax respective entities. cause literal value of <script>alert('name');</script> displayed rather being interpreted script block