RE: [PHP] security/sql issues with php

[Chris W. Parker]

bruce <mailto:[EMAIL PROTECTED]>
    on Wednesday, September 21, 2005 6:03 PM said:

> since i
> assume the '%x' chars traslate into something other than straight
> text, i assume that the html function you mention strips out these
> chars, or it returns a true/false if the data is valid.

Those characters are url encoded. If you were to do:

<?php echo $_GET['myvar1']; ?>

...and then viewed the source you'd see actual html and not the %x
characters.

If the data you're receiving should not have any html in it you should
use htmlspecialchars() to convert things like < and > to &lt; and &gt;,
which are harmless to the browser and will simply print < and > to the
screen. Viewing the source will show you &lt; and &gt;.



Chris.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php