KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
I am a bit confused, there are so many functions in PHP, and some using this, some using that. Some people use: htmlspecialchars() , htmlentities() , strip_tags() etc Which is the correct one and what do you guys usually use? Is this correct (advise me a better one, if any): $var = mysql_real_escape_string(htmlentities($_POST['username'])); This line can prevent MySQL injection and XSS attack?? Btw, is there any other things I need to pay attention besides XSS attack and MySQL injection? EDIT To conclude: If I want to insert string to the database, I do not need to use htmlentities , just use the mysql_real_escape_string . When displaying the data, use htmlentities() , is that what you all mean?? Summarize: mysql_real_escape_string used when insert into database htmlentities() used when outputting data into webpage htmlspecialchars() used when? strip_tags() used when? addslashes() used when? Can somebody fill in the question mark?
Tags (comma-separated)
Save Edits
Cancel