Re: Preventing SQL Injection/ Cross Site Scripting
| From: | Richard Lynch | Date: | Sun, 22 Apr 2007 05:21:02 +0000 |
| Subject: | Re: Preventing SQL Injection/ Cross Site Scripting | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-253472@lists.php.net to get a copy of this message | ||
On Sat, April 21, 2007 5:20 am, Dotan Cohen wrote:
> Although I can semicolons and the like, greater than and less than
> signs I want to keep as there are some rather witty people from the
> Mathematics faculty who will be using the comments. I'll str_replace()
> them to > and < however.
Store the original data (after mysql escaping).
Upon output to a browser, *ANY* data should have htmlentities() called
on it, unless you really really trust the author and have a secure
chain of evidence that it's kosher to let them put HTML/JS on your
site.
--
Some people have a "gift" link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/browse/from/lynch
Yeah, I get a buck. So?