Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
This is one of things that I really don’t get. I know that it’s super-important to escape any user sent data. There are lot of methods how to do that: stripslashes() (removes backslashes), strip_tags (removes HTML and PHP tags), htmlSpecialChars (for example, change & to &), regex’s (preg_match()) to do not allow process “bad” data.
When to use, how to use, why to use?
If you take the contents of, say,
$_POST['album_name'], and out put it directly on your page, then someone could submit HTML and JavaScript, which would then become a part of the page, and now your site is hacked.Or, you could take the contents of
$_POST['album_name']and put it into an SQL query. But the user has written their own SQL query, which you have now run, and now your database is hacked.http://xkcd.com/327/