Re: when to use htmlspecialchars()

If you will be using the data elsewhere then use it when it is displayed on the screen, or your other program will have to parse it. It is a good idea to always run htmlspecialchars when outputting text to the browser that came from a form. -- Stewart On Mon, 25 Feb 2002, Erik Price wrote: > I was wondering if anyone could give me some advice in deciding the most > appropriate time to use htmlspecialchars(): > > When user input is accepted and error-checked and ready to be inserted > into the database? Or when user input is pulled from the database and > ready to be displayed to the screen? > > It seems that running htmlspecialchars() BEFORE the data goes into the > database is the "safest" way to do it, so that potentially malicious > characters and tags never actually make it past the script. But upon > thinking about the implications of this, it strikes me that this will > affect the integrity of my data -- ideally, I want to keep the data as > "pristine" as possible while it is in the database, since it might end > up being parsed by something other than a browser someday, in which case > it would be best to leave the data as is. > > I'm leaning toward the second method, but I want to make sure that doing > so won't expose me to any risks that I haven't considered. Please give > me your thoughts on this. > > > Erik > > > > > > ---- > > Erik Price > Web Developer Temp > Media Lab, H.H. Brown > pricee@hhbrown.com > > >