andyjab ha scritto:
I am not really keen on the idea of storing potential XSS code in the
database and removing it when its displayed,
I agree with you infact I use Zend_Validator and Zend_Filter to prevent
this. My DB must be clean about XSS and all other "attacks".
And for the site performance is better to clean the data before write
them into DB (one time only) that clean them before display them (N times).
In Italy we say "prevenire è meglio che curare" (like: /better be safe
than sorry/)
M.
--
Michel 'ZioBudda' Morelli [email protected]
Consulenza sistemistica in ambito OpenSource.
Sviluppo applicazioni web dinamiche (LAMP+Ajax)
Telefono: 0200619074
Telefono Cell: +39-3939890025 -- Fax: +39-0291390660
http://www.ziobudda.net ICQ: 58351764
http://www.ziobuddalabs.it Skype: zio_budda
http://www.ajaxblog.it MSN: [email protected]
JABBER: [email protected]
