Question

Hey guys,
looked at the php docs and googled around, but no joy. This is my code snippet, the htmlspecialchars doesn’t seem to work, wrong use of it?

$query="SELECT * FROM likes";
$result=mysql_query($query);

$num=mysql_numrows($result);
$liked=htmlspecialchars($liked, ENT_QUOTES);
$liked=$_POST['liked'];

$query = "INSERT INTO likes VALUES ('','$name','$liked')";

thanks guys,
James

Answer 1

You are overwriting it with $_POST['liked'] in the immediately-following line. Switch the two lines. Or, just pass the POST var into the function directly:

$liked=htmlspecialchars($_POST['liked'], ENT_QUOTES);

Anyway you should be using mysql_real_escape_string() to escape your SQL query params. Save HTML escapes only for when you’re about to display the data.