不要相信外部源
<?php
$input = ‘<p><script>alert("You won the Nigerian lottery!");</script></p>‘;
echo htmlentities($input, ENT_QUOTES, ‘UTF-8‘);
// <p><script>alert("You won the Nigerian lottery!");</script></p>
原文：https://www.cnblogs.com/mingzhanghui/p/9326322.html