RE: [PHP-DB] Sanitizing user input for interaction with DB.

2002-01-13 Thread Beau Lebens
Hi Benny, I know this is a bit of a run-around again, but try the annotated manual on php.net, it has some good examples of using things here and there. Specifically useful functions are htmlspecialentities() htmlspecialchars() addslashes() stripslashes() nl2br() also, as far as using regexps

Re: [PHP-DB] Sanitizing user input for interaction with DB.

2002-01-13 Thread Bogdan Stancescu
I've started a thread on the topic some time ago on the php list, after some extensive reading and testing and these were the main conclusions: 1.1. ALWAYS pass addslashed values and always pass them quoted in the SQL statement. That is insert into table1 set id='$id' even if $id is known to