RE: [PHP] Validating User Input
| From: | Miguel Cruz | Date: | Fri, 19 Apr 2002 15:32:41 +0000 |
| Subject: | RE: [PHP] Validating User Input | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-93719@lists.php.net to get a copy of this message | ||
On Fri, 19 Apr 2002, SP wrote:
> Now should I include all those special characters? I want it to be hack
> proof so I don't want to add the user input into my database and have
> something bad happen.
>
> Which ones are safe?
> ~ ` ! @ # $ % ^ & * ( ) _ + - = [ ] \ { } | : " ; ' < > ? , . /
All characters are safe for database use as long as they're handled
properly.
Basically that means escaping ' " and \ which should be taken care of
automatically by addslashes (or by the abominable magic_quotes_gpc if you
happen to have it on).
Now, when you're dealing with path/file names and arguments to external
programs, you need to be more careful...
miguel