RE: [PHP] Re: How to escape apostrophe in HTML textbox exactly???
| From: | Chris W. Parker | Date: | Wed, 30 Jun 2004 17:14:04 +0000 |
| Subject: | RE: [PHP] Re: How to escape apostrophe in HTML textbox exactly??? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-189313@lists.php.net to get a copy of this message | ||
Torsten Roehr <mailto:roehr@zilleon.com>
on Wednesday, June 30, 2004 10:03 AM said:
> 1. get data from DB
> 2. convert for valid HTML output (stripslashes(), htmlentities())
> 3. output as HTML (into the form elements)
> 4. get POST data
> 5. escape POST data and insert into DB again
two comments:
first comment:
re: #2. why stripslashes()? if you've properly escaped your data before
the INSERT the slashes should be non-existant on the way out should they
not?
second comment:
you forgot #4.5 *validate* data to your specifications
chris.