validating form input
| From: | David Mehler | Date: | Thu, 08 Jul 2010 19:38:45 +0000 |
| Subject: | validating form input | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-306780@lists.php.net to get a copy of this message | ||
Hello,
Got a form that takes in data to enter in to a database. I want to
make it as secure and as invulnerable to sql injection and other
attacks as possible. I'm wondering if mysqli_real_escape_string or
stripslashes should be used or if the former does the latter. For
example, I have a name variable:
$name = mysqli_real_escape_string($DatabaseLink, trim($_POST['name']));
or should I do:
$name = stripslashes(mysqli_real_escape_string($dbc, trim($_POST['name'])));
Thanks.
Dave.