Re: Which characters to escape?

For MySQL to accept the data: Use the addSlashes function: http://php.net/addslashes For avoiding abusive input of HTML: Use the StripTags function: http://php.net/striptags To avoid abusive PHP input: Don't do it -- Allowing some random surfer to add PHP code to your site is just plain foolhardy. ----- Original Message ----- From: Nik Gare <nik@cheddarcheese.de> Newsgroups: php.general Sent: Sunday, January 07, 2001 8:29 AM Subject: [PHP] Which characters to escape? > Hi, > > I would like to use php to input a php/html mixture into a MySQL table, > but I am totally confused by which characters I have to escape. > If I do something like: > mysql_db_query('maidenheadms',SELE"INPUT templates SET name = > "header", > details = "$details"); > > and $details is something like: > > $item = split("/",$file_name,1024); > $i = 1; > while($item[$i] != ""){ > $page_file_name = $item[$i]; > $i++; > } > $result = mysql_db_query("maidenheadms","SELECT name FROM menu_items > WHERE details = \"$page_file_name\";", $db_link); > while($row = mysql_fetch_array($result)){ > $page_title = $row[0]; > } > > > echo "<html><head><title>Maidenead Multiple Sclerosis : "; > echo $page_title; > echo "</title><meta http-equiv=\"build\" content=\"October > 2000\"><meta > http-equiv=\"author\" content=\"cheddarcheese.de web design > (info@cheddarcheese.de)\"><meta name=\"description\" > content=\"Maidenhead > Multiple Sclerosis, Maidenhead MS, Multiple Sclerosis, MS\"></head><body > bgcolor=\"#eFd2b7\" text=\"#000000\" link=\"#f68033\" > alink=\"#F50000\" > vlink=\"#C95306\">"; > > which bits in $details do I have to escape, or 'double' escape? > > Thanks in advance, > Nik > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >