php - Insert HTML content into db table securely -
i'm using html function inserting html content db table , filter filtering user inputs against sql injection attacks. getting output prntscr.com/3c8ht . got following questions: 1) functions html content needs passed before insert , while output? 2) else filter function needed or there unused function? thx in advance function filter($data, $db) { $data = $db->escape_string($data); $data = htmlspecialchars($data, ent_ignore, 'utf-8'); $data = strip_tags($data); $data = stripslashes($data); $data = htmlentities($data); return $data; } function html($data, $db) { $data = $db->escape_string($data); return $data; } you should use escaping tool required medium, not anywhere. to avoid sql injection, mysql_real_escape_string() is, @ minimun, need use. better alternative using prepared statements , paramerized queries (look pdo extension, shipped php since v 5.1 iirc), safest option avoid kind of exploit. sending u...
