http://elbertf.com/2010/07/escaping-and-sanitizing-user-input-in-php/ Insights and Updates from a Tech Geek Thu, 10 May 2012 22:27:23 +0000 hourly 1 http://wordpress.org/?v=3.3.2 http://elbertf.com/2010/07/escaping-and-sanitizing-user-input-in-php/comment-page-1/#comment-319 Greg Mon, 23 Jan 2012 18:12:45 +0000 http://elbertf.com/?p=606#comment-319 Can you elaborate more on why you should not use strip tags? Perhaps a link with more information? Can you elaborate more on why you should not use strip tags? Perhaps a link with more information?

]]> http://elbertf.com/2010/07/escaping-and-sanitizing-user-input-in-php/comment-page-1/#comment-244 Kremchik Wed, 27 Apr 2011 15:37:36 +0000 http://elbertf.com/?p=606#comment-244 Nice article! I suppose there is a misprint in "MySQL database queries" section: - just '=' is missing. And how do you think, may be htmlspecialchars() is better than htmlentities()? There is a problem with htmlentities() if there are non-latin characters in the string. Nice article! I suppose there is a misprint in “MySQL database queries” section: - just ‘=’ is missing.
And how do you think, may be htmlspecialchars() is better than htmlentities()? There is a problem with htmlentities() if there are non-latin characters in the string.

]]> http://elbertf.com/2010/07/escaping-and-sanitizing-user-input-in-php/comment-page-1/#comment-90 ElbertF Sat, 24 Jul 2010 04:15:41 +0000 http://elbertf.com/?p=606#comment-90 I always do, didn't know it was exploitable though. I always do, didn’t know it was exploitable though.

]]> http://elbertf.com/2010/07/escaping-and-sanitizing-user-input-in-php/comment-page-1/#comment-85 svenn Fri, 23 Jul 2010 12:17:35 +0000 http://elbertf.com/?p=606#comment-85 Great post. If I read correct I should always use header() to encode UTF-8 when using UTF-8 on output aswell ? (to protect from <a href="http://shiflett.org/blog/2005/dec/googles-xss-vulnerability" rel="nofollow">http://shiflett.org/blog/2005/dec/googles-xss-vulnerability</a>) ? Great post. If I read correct I should always use header() to encode UTF-8 when using UTF-8 on output aswell ? (to protect from http://shiflett.org/blog/2005/dec/googles-xss-vulnerability) ?

]]>