Preventing non-persistent XSS attacks

In controllers:

PHP Code:

foreach($_GET as $key => $param) {
    $_GET[$key] = htmlentities($param, ENT_QUOTES | ENT_HTML5, 'UTF-8');
} 


It is a bad practice.
Escape just before outputting.
Because escaping depends on the context (in this case HTML output).

---

It's the browser that's executing the code, so I'm not sure that doing anything in PHP can prevent that.  I'm wondering if it could somehow detect any malicious content and redirect to a 'safe' url.

If the browser's JavaScript reads the query string in the URL and execute something and you get the popup,
you need to fix the JavaScript code.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper