XSS attacks and SQL injection prevention

PHP XSS Attack prevention If you like a product title, you can use Strip_tags () filter to erase all HTML tags.
If something like a product description, you can use the Htmlspecialchars () filter to escape the HTML tag.
SQL injection prevents numeric type parameters, which can be coerced into shaping using (int)/intval ().
A string type parameter that can be used to escape special characters using mysql_real_escape_string ().

java XSS attacks prevent input-time processing and use STRINGESCAPEUTILS.ESCAPEHTML4 ()/htmlutils.htmlescape () to filter.
Output processing, using <c:out value= "${msg}"/> to filter.
SQL injection Guard Stringescapeutils.escapesql () escapes the SQL parameter special characters.

XSS attacks and SQL injection prevention