Hi. Besides the formatting requirements of the php application, if I'm using prepared statements correctly do I need to sanitize user input in any other ways? If so, what's the numblest way?

That should be enough for input. For output, you sanitize with htmlentities.

1 members found this post helpful.

If you use prepared-statements (i.e. "placeholders"), you will prevent SQL-injection, because the user-supplied content is never understood to be part of the SQL statement that is to be executed.

You should also "de-fang" the inputs to ensure that users do not attempt to store information which, when replayed to a recipient's browser, would be interpreted as a malicious script. Likewise, when the contents of the database are presented by your program to a recipient's browser, any HTML-like content should be transformed (as described above) into HTML entities. For example, a string "<script>" would become a harmless "&lt;script&gt;" which will cause that literal string to appear in the output without any possibility of it being executed.

(To see exactly what I am talking about ... look at the "view page source" of this very page, to see what the LinuxQuestions forum-software did with the text of this post! The string that I used as my example ... has been transmogrified in precisely the way that I described. Thus, it is impossible for your browser to "execute" my post. You'll also see how the ampersands were also encoded as HTML-entities. You might have to "reload" the page to see the source-code of this posting.)

1 members found this post helpful.

Or htmlspecialchars if you are using characters above code 127 and don't want them transformed. (Don't forget about parameter#3 ($encoding))

1 members found this post helpful.

Thanks folks. Is the copyright symbol above 127?

What about xml input/output?

Also, what about when I want to preload forms for member editing?

I mean, obviously I don't want the user to view the entities.

Oh, okay, I just tested it. The form field interprets it the same as if it were the body.

Wait. This is confusing. If the data is stored in a database or xml with htmlspecialchar conversions and then output again with htmlspecialchar conversions you don't get your intended user output. But if you omit the conversion in your output you risk maliscious attacks against your guests.

Okay, I think I get it. Always use htmlspecialchars for input. Sundial was just saying if you do happen to allow literal html strings in storage always convert them for output. Correct?

> Thanks folks. Is the copyright symbol above 127?

Yes, its unicode (iso-8859-1, windows-1252) is 0xA9; html-code: &copy;

1 members found this post helpful.

> Always use htmlspecialchars for input.

Wrong. Always use it before/during output.

Now it is.