Re: performance question with htmlspecialchars,strip_tags

Use htmlspecialchars, not only for breaking your neat design, but for security. Someone might insert javascript and steal your cookies or session. Ryan A wrote:

Hi, I am programming for a webhosting directory site (to be) and we have some really huge forms...with as much as 45 fields in a single form and quite a few text/hidden boxes, multiply that by around 5-10 forms.... As you can imagine I dont want some jackass spoiling my neat tables by entering <h1> hahaha got you</h1> into it...so would you suggest I use HTMLSPECIALCHARS or STRIP_TAGS to do it? If I use either, will it slow down the rate of execution noticably? I am kind of leaning towards HTMLSPECIALCHARS as if someones name is Ryan 'O Conner it will happily take care of the " ' " there or if he accidentally puts Ryan "O Conner it will replace that with too...no need of the addslashes/strip slashes thing. Any experience with this and what do you suggest? Kindly reply. Cheers, -Ryan