Question

Will it be better if i add to mysql_real_escape_string also addslashes like that:

$username = mysql_real_escape_string(trim(addslashes($_POST['username'])));

And is there any need in this in password var:

$password = md5(mysql_real_escape_string(trim($_POST['password'])));

Also i read some topics about safe retrieving data from db…
it says that it would be better to retrieve data like that:

htmlentities(stripslashes($v))

Is it really necessary for safety?

Answer 1

• No, don’t use addslashes. It does not make the string more secure or better in any way, but adds complexity.
• Escape the string you want to store in the database. So instead of md5(mysql_real_escape_string($password)), do mysql_real_escape_string(md5($password)).
• Think about allowing spaces at the start and end of passwords, thus not trimming them.
• Use a salt when storing a password, for securities sake.