#clean strings

[sunoy14]

How to take care of your guitar.

How to take care of your guitar.

If you love your guitar and want it to play smoothly for as long as possible, you need to take very good care of your guitar. Especially acoustic guitars, since they sound better and better as the woods get older. So its good to preserve an acoustic guitar. That’s not to say that electric guitars do not need good care. They require the same care. So, here are some guidelines on taking good care…

View On WordPress

[tyleris]

It's a common misconception that user input can be filtered. PHP even has a (now deprecated) "feature", called magic-quotes, that builds on this idea. It's nonsense. Forget about filtering (Or cleaning, or whatever people call it). What you should do, to avoid problems is quite simple: Whenever you embed a string within foreign code, you must escape it, according to the rules of that language. For example, if you embed a string in some SQL targeting MySql, you must escape the string with MySql's function for this purpose (mysqli_real_escape_string). Another example is HTML: If you embed strings within HTML markup, you must escape it with htmlspecialchars. This means that every single echo or print statement should use htmlspecialchars. A third example could be shell commands: If you are going to embed strings (Such as arguments) to external commands, and call them with exec, then you must use escapeshellcmd and escapeshellarg. And so on and so forth ... The only case where you need to actively filter data, is if you're accepting preformatted input. Eg. if you let your users post HTML markup, that you plan to display on the site. However, you should be wise to avoid this at all cost, since no matter how well you filter it, it will always be a potential security hole.

troelskn