On your web page
https://www.w3schools.com/php/showphp.asp?filename=demo_form_validation_escapechar
and there is code there for validating the data entered. The function however is never run as any %^#$ data entered is still echoed in the echo line.
Surely, these characters should have been removed ?
Thanks Wallace