Re: Using DB: do I need to quoteSmart() AND strip_tags() all user input?

What I'm thinking of doing with strip_tags() makes sense, right? Ive read about a vulnerability for VIEWERS of what is posted rather than the database itself. This is where the user posts some bad script in the field and when it is displayed, it causes something harmful to the person's browser who is viewing it at that time. strip_tags() can delete all html tags before it goes to database since it strips HTML and PHP tags. Ideas? Thoughts? Best practices? --- Justin Patrin <papercrane@gmail.com> wrote: > On Mon, 14 Mar 2005 13:07:05 -0800 (PST), l > Burnerheimerton > <lburnerheimerton@yahoo.com> wrote: > > I am using DB, php 4.28, and MySQL 3.23. > > > > I want to ensure nothing gets into database that > could > > be harmful. > > > > quoteSmart() will correctly quote input and > > strip_tags() will strip input of anything that > might > > be harmful to person who views database in dynamic > > page. > > > > Do you guys use both to snatize user input? > > > > Best practices? > > > > Best practice is to uoe quoteSmart on any DB values > when putting them in SQL. > > For HTML, you can decide on your own, but if you > don't want to allow > HTML, but want people to be able to post HTML code > (for viewing) use > htmlentities() when *outputting* the content. > > -- > Justin Patrin > > -- > PEAR General Mailing List (http://pear.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/