Re: does DataObject_FormBuilder addslashes or stripslashes as needed when insert and updating into database?

On Thu, 6 Jan 2005 12:52:12 -0800 (PST), l Burnerheimerton <lburnerheimerton@yahoo.com> wrote: > The bottom line is that if we are using Formbuilder, DB_Dataobject is taking > care of it for us. If we are NOT using Formbuilder or Dataobject, we need > to check input manually using samrtquote or somewthing like that - right? HTML_QuickForm handles the HTML side of it. DB_DataObject handles the SQL side of it. Any time you're creating SQL yourself you need to make sure that the values you're putting in are checked. You can run your own filters or use DB::quoteSmart. Just make sure you're doing quoting at the right times. http://www.reversefold.com/tikiwiki/tiki-index.php?page=PHPFAQs#id386728 > > Justin Patrin <papercrane@gmail.com> wrote: > On Thu, 6 Jan 2005 07:59:53 -0800 (PST), l Burnerheimerton > wrote: > > I was looking at my quickform rules in Formbuilder and wondered if I need > to do additional checks if FormBuilder does not addslashes or stripslashes > as needed. > > HTML_QuickForm handles stripslashes if magic_quotes_gpc() is on. It > also handles escaping quotes and such when ouputting (htmlentities, > NOT addslashes). > > DB_DataObject handles escaping when doing DB operations (as it should, > the values in the member vars should be the real values, not escaped > ones). It does this with DB::quoteSmart(), not addslashes(). > > OT: > addslashes() is a last-ditch option. You should always use a more > specific escaping option when one exists (DB::quoteSmart(), > mysql_real_escape_string() (quoteSMart uses this for mysql), > htmlentities(), escapeshellcmd(), escapeshellarg(), etc.). > > > > > Thanks. > > > > -- > Justin Patrin > -- Justin Patrin