JavaScript-Background new data, need to block insert <script> script

1, do a background, using AJAX to send data to the PHP interface, and then the database to operate. If a new piece of data is added, how do you block it?
2, try to get the data at the front desk with the use of each string to escape, try to use mysql_real_escape_string in the background (). But the database is still in the angle bracket format, and there will be pop-up window.
3, the use of this function to escape, and then read the database on the Web page, the alert statement is still executed as usual, ask the big God pointing twos ~

function html_encode(str){     var s = "";     if (str.length == 0) return "";     s = str.replace(/&/g, ">");     s = s.replace(//g, ">");     s = s.replace(/ /g, " ");     s = s.replace(/\'/g, "'");     s = s.replace(/\"/g, """);     s = s.replace(/\n/g, "
");     return s;   }

Reply content:

1, do a background, using AJAX to send data to the PHP interface, and then the database to operate. If a new piece of data is added, how do you block it?
2, try to get the data at the front desk with the use of each string to escape, try to use mysql_real_escape_string in the background (). But the database is still in the angle bracket format, and there will be pop-up window.
3, the use of this function to escape, and then read the database on the Web page, the alert statement is still executed as usual, ask the big God pointing twos ~

function html_encode(str){     var s = "";     if (str.length == 0) return "";     s = str.replace(/&/g, ">");     s = s.replace(//g, ">");     s = s.replace(/ /g, " ");     s = s.replace(/\'/g, "'");     s = s.replace(/\"/g, """);     s = s.replace(/\n/g, "
");     return s;   }

A) PHP has a specialized function for converting special characters to solid characters, htmlspecialchars ().
b) In fact, the more convenient way is to escape when the output, such as smarty have escape and other methods
c) Use WYSIWYG editor with script tag filter built into the editor
D) If you just don't use the script tag, you can do it before you put it in the database preg_replace('/<(script\b[^>]*)>/i', '%lt;$1%gt;', $content) .
e) If the front desk does not have the problem, the most convenient way is to the back-end operators to strengthen education, so that they do not mess.

You have no problem with this JS function, to see if it is in the database where the time to turn back

htmlspecialchars()

