Security Check by wodhas

I’m running two PHP application on web server. I have to questions 1. I replaced “on” to o&#110 using str_replace to prevent XSS attack. so if someone tries “onreadystatechange=’something'”, it appears like “o&#110readystatechange=’something’ on admin’s page… (Budget: $30-$250 USD, Jobs: Javascript, Web Security)