Re: XSS Preventing.
| From: | Martin Zvarík | Date: | Tue, 23 Jun 2009 14:29:25 +0000 |
| Subject: | Re: XSS Preventing. | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-294449@lists.php.net to get a copy of this message | ||
Don't htmlentiies() before DB save. In general: - mysql_real_escape_string() before DB insertion - htmlentities() before dispalyI, on the other hand, would do htmlentities() BEFORE insertion. Pros: --- The text is processed once and doesn't have to be htmlentitied() everytime you read the database - what a stupid waste of performance anyway. Cons: --- Instead "&" you'll see "&" ... is that a problem? Not for me and I believe 80% of others who use DB to store & view on web. Martin