Re: Re: XSS Preventing.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Jun 26, 2009 at 12:07 PM, Chris Shiflett<shiflett@xxxxxxx> wrote:
> On Jun 23, 2009, at 10:29, Martin Zvarík wrote:
>
>>> Don't htmlentiies() before DB save.  In general:
>>> - mysql_real_escape_string() before DB insertion
>>> - htmlentities() before dispaly
>>
>> I, on the other hand, would do htmlentities() BEFORE insertion.
>>
>> Pros:
>> ---
>> The text is processed once and doesn't have to be htmlentitied() everytime
>> you read the database - what a stupid waste of performance anyway.
>
> Isn't reading from the database every time a much bigger waste? Sounds like
> you might benefit from reading about Amdahl's law:
>
> http://en.wikipedia.org/wiki/Amdahl%27s_law
>
> Additionally, these slides from a talk by George Schlossnagle are good:
>
> http://schlossnagle.org/~george/talks/ZendPerf.pdf
>
> Amdahl's law aside, it does make sense in some cases (profiles for social
> apps, for example) to cache this information in a ready-to-be-displayed
> format, but no one should be talking about "performance" and "reading from
> the database every time" in the same sentence.
>
> Chris
>
> --
> Chris Shiflett
> http://shiflett.org/
>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

Fantastic PDF from the George Schlossnagle

http://schlossnagle.org/~george/talks/ZendPerf.pdf


Thanks

-- 

Bastien

Cat, the other other white meat

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux