Re: Using DB: do I need to quoteSmart() AND strip_tags() all user input?
| From: | Justin Patrin | Date: | Mon, 14 Mar 2005 21:29:27 +0000 |
| Subject: | Re: Using DB: do I need to quoteSmart() AND strip_tags() all user input? | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-18039@lists.php.net to get a copy of this message | ||
On Mon, 14 Mar 2005 13:07:05 -0800 (PST), l Burnerheimerton
<lburnerheimerton@yahoo.com> wrote:
> I am using DB, php 4.28, and MySQL 3.23.
>
> I want to ensure nothing gets into database that could
> be harmful.
>
> quoteSmart() will correctly quote input and
> strip_tags() will strip input of anything that might
> be harmful to person who views database in dynamic
> page.
>
> Do you guys use both to snatize user input?
>
> Best practices?
>
Best practice is to uoe quoteSmart on any DB values when putting them in SQL.
For HTML, you can decide on your own, but if you don't want to allow
HTML, but want people to be able to post HTML code (for viewing) use
htmlentities() when *outputting* the content.
--
Justin Patrin