Home/ Questions/Q 7792511
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T22:12:26+00:00

Ive read every post here on escaping and unfortunately almost every one has disagreements

  • 0

Ive read every post here on escaping and unfortunately almost every one has disagreements amongst posters so I just want to ask the community about my specific situation before I make a major mistake because I misunderstood another post.

I am storing user preferences in a MySQL database where I personally place the information directly into the database myself, not user submitted inputs.

My questions are:

1.) If I am running a PHP query and placing the query result into other PHP code blocks, not as HTML but just as things like other queries, ie(SELECT * from $queryresult) there is no need to escape this correct?

2.) If I am outputting what I stored in the database as html directly from the database do I need to sanitize this output in anyway. My understanding is that sanitization is strictly for user submitted input. Need I really worry about data coming out of database fields I personally populated.

I think I know the answers here after reading but I dont want to leave any room for error on this one.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Question 1 – Escaping data for MySQL queries

    No, you must always escape data in your queries, regardless of the source. Data escaping is for the query parser. Even if the data comes from your own code, you must escape it.

    Learn to use PDO to avoid this problem.

    Question 2 – Escaping data for HTML

    If you are outputting data to HTML, you must always escape it with htmlspecialchars() or equivalent. This is so you don’t have to worry about bad HTML code, as well as XSS.

    • 0