Re: Re: Filtering and Escaping (Was: Select and $_POST)
| From: | Chris Shiflett | Date: | Tue, 15 Nov 2005 00:24:57 +0000 |
| Subject: | Re: Re: Filtering and Escaping (Was: Select and $_POST) | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-225794@lists.php.net to get a copy of this message | ||
GamblerZG wrote:
If you had anything other than $_OCLEAN in an echo and friends, then you would know you were screwing up. Personally, if I pull something info from the database, then I do not usually sanitize it. Yes, I know it's less secure, but I'm willing to take such (negligible) risk for extra performance. So I sanitize data on input only.Sanitizing is an alias for filtering and has nothing to do with escaping. One should never be considered a substitute for the other, although this is a common mistake. Chris -- Chris Shiflett Brain Bulb, The PHP Consultancy http://brainbulb.com/