Question

I have a PHP script that very much like a commenting system, but requires a confirmation of the suggested comment first.

Example:

1) User enters comment.
2) Users is sent to confirm page that displays comment and ask user to confirm it is correct.
3) User confirms and the comment is inserted into a database.

My questions is, which PHP functions are best to secure the display of the the comment on the confirm page, and then to insert it into a database. Do i also need something to secure it after fetching it from a database for display afterwards?

Answer 1

If you talk about code security, one should always stick to the golden rules :

• Filter all input ( filter_var() or any framework included class)
• Escape all output ( at least htmlspecialchars() )

There are many levels to secure a form, or an entire application. These two are just primers.