https://www.icyphoenix.com/viewtopic.php?f=17&t=9350&p=59909#p59909
-----------------------------------
mort
Sat 22 Nov, 2014 21:21

Re: You Do Not Sanitize Data In $_GET
-----------------------------------
Thanks Mate, ;)

I understand that what you are saying is to put the data into the DB as raw data - such as ' and " and then clean it up with the html entities, specialchars, _decode etc when it's requested?

Sounds easy - But it's giving me a headache trying to get it all to work even though I've removed all the htmlentities from the DB and treat them on request with html :(

I have a lot of files that have spaces in the html "name" in url's like <a href="blah" title="The little Red Hen"></a> which I fill with string replace [b]" "[/b] with [b]%20[/b] so that there are no html errors.

Now I can't even get that to work any more?  :( 

And it started because of this ->

[code linenumbers=false]function sanitize($val){

	$val = trim($val);

	if(get_magic_quotes_gpc()) {
	$val = stripslashes($val);
	}
	$val = strip_tags($val);
	$val = htmlspecialchars($val, ENT_QUOTES,'UTF-8');

	return mysql_real_escape_string($val);
}[/code]

I was advised by someone who's fairly professional that htmlentities shouldn't be used in the DB and I should remove it from this function..

If you agree - I'll pursue all of the problems that it's created - If you don't - I'll put it back the way it was.  :twisted:


