Using DB: do I need to quoteSmart() AND strip_tags() all user input?
| From: | l Burnerheimerton | Date: | Mon, 14 Mar 2005 21:07:05 +0000 |
| Subject: | Using DB: do I need to quoteSmart() AND strip_tags() all user input? | ||
| Groups: | php.pear.general | ||
| Request: | Send a blank email to pear-general+get-18034@lists.php.net to get a copy of this message | ||
I am using DB, php 4.28, and MySQL 3.23.
I want to ensure nothing gets into database that could
be harmful.
quoteSmart() will correctly quote input and
strip_tags() will strip input of anything that might
be harmful to person who views database in dynamic
page.
Do you guys use both to snatize user input?
Best practices?
Thanks.
__________________________________
Do you Yahoo!?
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/