Re: escape your variables
| From: | Kyle Terry | Date: | Thu, 05 Mar 2009 02:58:44 +0000 |
| Subject: | Re: escape your variables | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-289330@lists.php.net to get a copy of this message | ||
On Wed, Mar 4, 2009 at 6:55 PM, Chris <dmagick@gmail.com> wrote:
> Eric Butera wrote:
>
>> On Wed, Mar 4, 2009 at 8:18 PM, Chris <dmagick@gmail.com> wrote:
>>
>>> You only need to escape data coming from a user going in to your
>>> database.
>>>
>>
>> If you put user input into your database and pull it back out, it's
>> still raw user input. Never trust any piece of data ever, whether it
>> comes from a superglobal OR within your app itself.
>>
>
> Isn't that what I said?
>
> --
> Postgresql & php tutorials
> http://www.designmagick.com/
>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
Actually no; you said "You only need to escape data coming from a user going
in to your database."