Question

I have a javascript-based rich text editor.

What is the safest way to save the tags it generates?

I’m using MySQL as my database.

I’m not sure if using mysql_real_escape_string($text); is safe.

Answer 1

I can’t think of a reason to use htmlentities here. mysql_real_escape_string is vital here because it prevents people from injecting malicious SQL code like ';DROP * FROM table foo;-- into you database. I’d try it without htmlentities, if you find that you need to convert to entities then you could try htmlspecialchars instead which only converts special characters.

If you want to limit the allowed HTML in your form you might also want to look into the strip_tags function.

Relevant documentation:
https://www.php.net/manual/en/function.htmlentities.php
https://www.php.net/manual/en/function.htmlspecialchars.php

Good luck