note 93577 added to function.htmlspecialchars

Just a few notes on how one can use htmlspecialchars() and htmlentities() to filter user input on forms for later display and/or database storage... 1. Use htmlspecialchars() to filter text input values for html input tags. i.e., echo '<input name=userdata type=text value="'.htmlspecialchars($data).'" />'; 2. Use htmlentities() to filter the same data values for most other kinds of html tags, i.e., echo '<p>'.htmlentities($data).'</p>'; 3. Use your database escape string function to filter the data for database updates & insertions, for instance, using postgresql, pg_query($connection,"UPDATE datatable SET datavalue='".pg_escape_string($data)."'"); This strategy seems to work well and consistently, without restricting anything the user might like to type and display, while still providing a good deal of protection against a wide variety of html and database escape sequence injections, which might otherwise be introduced through deliberate and/or accidental input of such character sequences by users submitting their input data via html forms. ---- Server IP: 64.71.164.2 Probable Submitter: 24.171.65.25 ---- Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars.php Edit -- https://master.php.net/note/edit/93577 Del: integrated -- https://master.php.net/note/delete/93577/integrated Del: useless -- https://master.php.net/note/delete/93577/useless Del: bad code -- https://master.php.net/note/delete/93577/bad+code Del: spam -- https://master.php.net/note/delete/93577/spam Del: non-english -- https://master.php.net/note/delete/93577/non-english Del: in docs -- https://master.php.net/note/delete/93577/in+docs Del: other reasons-- https://master.php.net/note/delete/93577 Reject -- https://master.php.net/note/reject/93577 Search -- https://master.php.net/manage/user-notes.php