Re: Using DB: do I need to quoteSmart() AND strip_tags() all user input?
| From: | Massimiliano Arione | Date: | Tue, 15 Mar 2005 08:10:06 +0000 |
| Subject: | Re: Using DB: do I need to quoteSmart() AND strip_tags() all user input? | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-18062@lists.php.net to get a copy of this message | ||
l Burnerheimerton wrote:
I am using DB, php 4.28, and MySQL 3.23. I want to ensure nothing gets into database that could be harmful. quoteSmart() will correctly quote input and strip_tags() will strip input of anything that might be harmful to person who views database in dynamic page. Do you guys use both to snatize user input? Best practices?I just use placeholders or autoExecute() They both use appropriate quoting and escaping, so I don't need quoteSmart() For strip_tags(), it depends on you (see Justin's reply) -- Massimiliano Arione :: http://www.garak.it/ :: * NO WORD * http://gnu.org/philosophy/no-word-attachments.html * NO HTML * http://efn.no/html-bad.html