On 16. Jan 2009, at 12:28, andyjab wrote:
Am I correct in thinking that this means that any attempt to embed a
query
(an sql injection) into the form wouldn't work? In the same way that
mysql_escape_string function works?
Yes.
Do I really need then to regular expression the input on the form?
Depends. Do you mind if they enter "hello" in the email field and a
250-character title?
If yes, you might want to conside using Zend_Validate_* instead of
regexp wherever possible.
Or should I be concerning myself about other possible issues ? Such
as XSS?
To prevent XSS make sure to properly escape those values when
displaying them.
Jaka
