note 109746 added to function.filter-var

There is seemingly a lot of confusion when to sanitise data. I've written two blogs posts on the topic, "Input sanitization and escaping for database and STDOUT using PHP" (http://anuary.com/54/input-sanitization-and-escaping-for-database-and-stdout-using-php) and "Why input sanitization is evil?" (http://anuary.com/55/why-input-sanitization-is-evil). Essentially, data sanitisation should never be used to "fix" form input. The following code is a schematic example of a common misuse of FILTER_SANITIZE_STRING. <?php $equation = filter_input(INPUT_POST, 'equation', FILTER_SANITIZE_STRING); if(!empty($equation)) { // store to the database } ?> This will produce unexpected results in case input contains a tag, e.g. "1 < 2, 4 > 2" will be converted to "1 2". For more information on how to use filter_var and when not to use it, read the two articles with the links above. ---- Server IP: 69.147.83.197 Probable Submitter: 49.144.127.203 ---- Manual Page -- http://www.php.net/manual/en/function.filter-var.php Edit -- https://master.php.net/note/edit/109746 Del: integrated -- https://master.php.net/note/delete/109746/integrated Del: useless -- https://master.php.net/note/delete/109746/useless Del: bad code -- https://master.php.net/note/delete/109746/bad+code Del: spam -- https://master.php.net/note/delete/109746/spam Del: non-english -- https://master.php.net/note/delete/109746/non-english Del: in docs -- https://master.php.net/note/delete/109746/in+docs Del: other reasons-- https://master.php.net/note/delete/109746 Reject -- https://master.php.net/note/reject/109746 Search -- https://master.php.net/manage/user-notes.php