RE: [PHP] security/sql issues with php
| From: | Chris W. Parker | Date: | Thu, 22 Sep 2005 01:14:06 +0000 |
| Subject: | RE: [PHP] security/sql issues with php | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-222952@lists.php.net to get a copy of this message | ||
bruce <mailto:bedouglas@earthlink.net>
on Wednesday, September 21, 2005 6:03 PM said:
> since i
> assume the '%x' chars traslate into something other than straight
> text, i assume that the html function you mention strips out these
> chars, or it returns a true/false if the data is valid.
Those characters are url encoded. If you were to do:
<?php echo $_GET['myvar1']; ?>
...and then viewed the source you'd see actual html and not the %x
characters.
If the data you're receiving should not have any html in it you should
use htmlspecialchars() to convert things like < and > to < and >,
which are harmless to the browser and will simply print < and > to the
screen. Viewing the source will show you < and >.
Chris.