Re: Preventing XSS Attacks

From:	tedd	Date:	Thu, 11 Jun 2009 13:28:25 +0000
Subject:	Re: Preventing XSS Attacks
References:	1 2 3 4 5 6 7 8 9 10 11 12	Groups:	php.general
Request:	Send a blank email to php-general+get-293928@lists.php.net to get a copy of this message

At 7:08 PM +0100 6/10/09, Ashley Sheridan wrote:

So something like this would be acceptable?: $searchTerms = (isset($_REQUEST['q']))?$_REQUEST['q']:''; $searchTerms = htmlentities($searchTerms); $dbSearchTerms = mysql_real_escape_string($searchTerms); Giving me two variables, one for display output to user, the other for use in the database? Thanks Ash

Ash: I wouldn't use $_REQUEST. If you know the request method then use it. There can be problems using $_REQUEST. Cheers, tedd -- ------- http://sperling.com http://ancientstones.com http://earthstones.com