Question

I just want to know if I’m doing it right.

PHP

<?php 
if(isset($_POST['email']) && isset($_POST['password'])) {
    $email = htmlentities(mysql_real_escape_string($_POST['email']));
    // then hash password
}
?>

HTML

<form action="" method="POST">
    <input type="email" name="email" />
    <input type="password" name="password" />
    <input type="submit" name="Login" />
</form>

is it good to do htmlentities() together with mysql_real_escape_string?
Or what do I need to do?

Answer 1

I would say htmlentities() are good to prevent XSS attacks. So, if you’re gonna re-render this data back to HTML format again, use it. If you’re only worried about well-known SQL Injection attacks, I would say mysql_real_escape_string() is enough for you.

remember that you need to decode HTML entities, once you’re gonna show them again.