Re: does DataObject_FormBuilder addslashes or stripslashes as needed when insert and updating into database?

On Thu, 6 Jan 2005 07:59:53 -0800 (PST), l Burnerheimerton <lburnerheimerton@yahoo.com> wrote: > I was looking at my quickform rules in Formbuilder and wondered if I need to do additional > checks if FormBuilder does not addslashes or stripslashes as needed. HTML_QuickForm handles stripslashes if magic_quotes_gpc() is on. It also handles escaping quotes and such when ouputting (htmlentities, NOT addslashes). DB_DataObject handles escaping when doing DB operations (as it should, the values in the member vars should be the real values, not escaped ones). It does this with DB::quoteSmart(), not addslashes(). OT: addslashes() is a last-ditch option. You should always use a more specific escaping option when one exists (DB::quoteSmart(), mysql_real_escape_string() (quoteSMart uses this for mysql), htmlentities(), escapeshellcmd(), escapeshellarg(), etc.). > > Thanks. > -- Justin Patrin