PHP security in getting a parameter value -

i dont know php forgive ignorance. trying have parameter value entered in joomla admin area append string bootstrap container class change page fixed fluid layout.

i retrieving value this...

$contype = $this->params->get('contype',''); 

and setting follows...

class="container<?php echo "$contype"; ?> 

however, worried (knowing little php) if security problem since value set $contype - problem? if so, work instead...?

$contype = (int) $this->params->get('contype','0');  if($contype == "1") {  $contype = "-fluid"; } else {  $contype = ' '; } 

and echo again. necessary? there better way?

yes, work , secure.

if $contype can parameter, important escape against xss using htmlentities():

echo htmlentities($contype) 

the way did better, although costs more effort. ;-)

just remember use htmlentities in future if need escaping of many parameters , not 1 small customization. , advise, please inform php , security before continuing develop php applications (if planning to). web developer (especially php developer), should know topics "xss", "sql injection" , "csrf". :-)

[as alternative htmlentities, there htmlspecialchars, encodes less characters, see htmlentities() vs. htmlspecialchars() comparison]