Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I have a page, where I have approximately 90 items I need to output. Most of them are object properties (I am using ORM so these objects map to my database tables). But the question is, do I have to encode each of those 90 outputs by applying functions to each (in my case, the htmlspecialchars)? Wouldn’t that add a bit of an overhead (calling a single function 90 times)?
EDIT: The term is “output encoding”…hehe
Someone will, at some point, enter data that can mess up your HTML page. They may do this accidentally (the company name has an “>” in it), or intentionally (see XSS).
So, yes, always properly encode output.