First, read up about these in the Drupal API:
check_plain() encodes special characters into a plain-text string that is then displayed as HTML, while
filter_xss() filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. It does four things:
- Removing characters and constructs that can trick browsers
- Making sure all HTML entities are well-formed
- Making sure all HTML tags and attributes are well-formed
Both functions are used to santize data from users to make sure that any user injection is neutralized before the data is rendered on your site.
You never pass the same string through both.
If you use
check_plain() then the string passed to the function is supposed to be used as plain text (not HTML). Then
filter_xss() is not needed.
If you use
filter_xss(), then the string passed to the function is supposed to be HTML, and
check_plain() will mess it up.
Now, what is rendered on a page is usually HTML. In Drupal, ordinary user input into an entity is santized upon input (by means of a text filter such as "Filtered HTML"). Using
filter_xss()to santize output coming from already sanitized fields will break output.
When I look at the template you use as example, it looks to me as if all three fields passed to
print() comes from content that is already sanitized, and need no more sanitazion.
However, if you create your own module that collects user input without passing it through a "safe" text filter such as "Filtered HTML" or "Plain", you must use these functions for sanitazion purposes.