Current practice: URL-encode user text before placing it in a query string, cap the input length, and escape any text that is written back into HTML.
Generating the QR request safely
The QR image endpoint can stay the same. The browser only needs to encode the text before building the image and download URLs.
<script>const text =document.getElementById('t1').value.slice(0,200);const encoded =encodeURIComponent(text);document.getElementById('display').innerHTML =`<img src="qr_generate.php?str=${encoded}" alt="Generated QR code">`;</script>
I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery,
and web development at plus2net. The tutorials focus on clear explanations, working
examples, and code that readers can test and adapt while learning.