Re: htmlentities
| From: | Stephen | Date: | Fri, 22 Jul 2016 02:11:03 +0000 |
| Subject: | Re: htmlentities | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-325650@lists.php.net to get a copy of this message | ||
On 16-07-21 09:50 PM, Aziz Saleh wrote:
Prepared statements have nothing to do with htmlentities (probably since its an old code it was doing it wrong, should have been using mysql_real_escape_string). Prepared statements make it (mostly) safe to store in database (stopping sql hacks). htmlentities is for outputting html to the user (stopping html/css/js injections to the page). If you are outputting the content to the user (and data is provided by users) you should make sure it is correctly escaped before displaying. Similar question on SE: http://stackoverflow.com/questions/1219159/do-i-need-htmlentities-or-htmlspecialchars-in-prepared-statementsThat you! -- Stephen