Re: Re: How to escape apostrophe in HTML textbox exactly???
| From: | Torsten Roehr | Date: | Wed, 30 Jun 2004 17:33:37 +0000 |
| Subject: | Re: Re: How to escape apostrophe in HTML textbox exactly??? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-189321@lists.php.net to get a copy of this message | ||
>"Chris W. Parker" <cparker@swatgear.com> wrote in message
news:001BD19C96E6E64E8750D72C2EA0ECEE65DE9E@ATI-EX->01.ati.local...
>Torsten Roehr <mailto:roehr@zilleon.com>
> on Wednesday, June 30, 2004 10:03 AM said:
>
>> 1. get data from DB
>> 2. convert for valid HTML output (stripslashes(), htmlentities())
>> 3. output as HTML (into the form elements)
>> 4. get POST data
>> 5. escape POST data and insert into DB again
>
>two comments:
>
>first comment:
>
>re: #2. why stripslashes()? if you've properly escaped your data before
>the INSERT the slashes should be non-existant on the way out should they
>not?
Correct. My fault.
>
>second comment:
>
>you forgot #4.5 *validate* data to your specifications
Correct also. But I was focusing in the quote problem ;)
Torsten