RE: security/sql issues with php

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



bruce <mailto:bedouglas@xxxxxxxxxxxxx>
    on Wednesday, September 21, 2005 6:03 PM said:

> since i
> assume the '%x' chars traslate into something other than straight
> text, i assume that the html function you mention strips out these
> chars, or it returns a true/false if the data is valid.

Those characters are url encoded. If you were to do:

<?php echo $_GET['myvar1']; ?>

...and then viewed the source you'd see actual html and not the %x
characters.

If the data you're receiving should not have any html in it you should
use htmlspecialchars() to convert things like < and > to &lt; and &gt;,
which are harmless to the browser and will simply print < and > to the
screen. Viewing the source will show you &lt; and &gt;.



Chris.

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux