Description:
------------
The very first code example in the "PHP and HTML" FAQ 
(http://www.php.net/manual/en/faq.html.php) includes this code sample:

<?php
    echo "<input type='hidden' value='" . htmlspecialchars($data) . "' />\n";
?>

This code would be vulnerable to XSS if the input type was anything other than 
'hidden', since the value attribute is single quoted and htmlspecialchars does 
not escape single quotes by default. Even the hidden input would be vulnerable 
in some older browsers that allow repeating the type attribute (allowing XSS 
with something like $data = "' onmouseover='alert(document.cookie); 
type='text";).

Since this FAQ is meant to show users how to include PHP variables in a HTML 
page it would seem like a good place encourage good escaping practices. I would 
suggest this example is at least changed to:

<?php
    echo '<input type="hidden" value="' . htmlspecialchars($data) . '" />';
?>

but this section of the FAQ might also benefit from some "how do I prevent 
cross-site scripting" examples.