note 109746 deleted from function.filter-var by danbrown

Note Submitter: g dot kuizinas at anuary dot com ---- There is seemingly a lot of confusion when to sanitise data. I've written two blogs posts on the topic, "Input sanitization and escaping for database and STDOUT using PHP" (http://anuary.com/54/input-sanitization-and-escaping-for-database-and-stdout-using-php) and "Why input sanitization is evil?" (http://anuary.com/55/why-input-sanitization-is-evil). Essentially, data sanitisation should never be used to "fix" form input. The following code is a schematic example of a common misuse of FILTER_SANITIZE_STRING. <?php $equation = filter_input(INPUT_POST, 'equation', FILTER_SANITIZE_STRING); if(!empty($equation)) { // store to the database } ?> This will produce unexpected results in case input contains a tag, e.g. "1 < 2, 4 > 2" will be converted to "1 2". For more information on how to use filter_var and when not to use it, read the two articles with the links above.