Re: performance question with htmlspecialchars,strip_tags

No, use it when you display data in an HTML page. That way, you don't lose the freedom to display the DB data in other formats. Marek Kilimajer wrote:

Use htmlspecialchars only when you insert into db, this will not make a significant difference. Ryan A wrote:

Hey there, Thanks for replying. So many htmlspecialchars($string)'s, wont it make my scripts slower? I just want to know if it will make my script very slow and put a lot of pressure on processing in the long run or it normal... Cheers, -Ryan

Use htmlspecialchars, not only for breaking your neat design, but for security. Someone might insert javascript and steal your cookies or

session.

Ryan A wrote:

Hi, I am programming for a webhosting directory site (to be) and we have some really huge forms...with as much as 45 fields in a single form and quite

a

few text/hidden boxes, multiply that by around 5-10 forms.... As you can imagine I dont want some jackass spoiling my neat tables by entering <h1> hahaha got you</h1> into it...so would you suggest I use HTMLSPECIALCHARS or STRIP_TAGS to do it? If I use either, will it slow down the rate of execution noticably? I am kind of leaning towards HTMLSPECIALCHARS as if someones name is Ryan 'O Conner it will happily take care of the " ' " there or if he accidentally puts Ryan "O Conner it will replace that with too...no need of the addslashes/strip slashes thing. Any experience with this and what do you suggest? Kindly reply. Cheers, -Ryan

-- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

-- The above message is encrypted with double rot13 encoding. Any unauthorized attempt to decrypt it will be prosecuted to the full extent of the law.