Cookies are client-controlled input. Check for the key and escape a value before putting it into HTML.
<?php
$value = $_COOKIE['Plus2netCookie'] ?? '';
if ($value !== '') {
echo htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
}
?>Secure on HTTPS sites, HttpOnly when JavaScript does not need the cookie, and choose SameSite according to the cross-site behavior your application requires.$value = (string) ($_COOKIE['Plus2netCookie'] ?? '');
echo htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
Author & Instructor at plus2net
I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.