Re: HTML in MySQL?

On Tue, 28 Nov 2000, Broder B wrote: > Yo! > I was wondering about characters like <> and MySQL. I am pretty sure I have read > somewhere that those characters should be avoided in a MySQL database. I have tried and I have not > have any troubble, so is it really bad? If that so what could I do to remove those chars and still > have it when I get the data from MySQL nad show it as a webpage? > Yo? Well, fine. It's not that the characters are a problem in the database. Frankly, the database doesn't care one iota as to what's inside of it. It's when it comes time to output the code. If you have untrusted users entering data, it is possible that they could put malicious HTML (<script>top.close()</script>, for example) into the database. Then come time to print it out, well, you know. The ways to avoid that are: 1) Only allow trusted users to enter raw HTML, and 2) Use htmlspecialchars() on untrusted data. -- Ignacio Vazquez-Abrams <ignacio@openservices.net>