I have a database sanitizing function that I use when the user enters some data into my website. I escaping the mysqli characters with mysqli_real_escape_string(), but I wish to also output the content with htmlspecialchars(). The problem is, let's just say the user enters something with a single quote; that will be escaped by the sanitize function and will be output as \'. Is there any way to store it like that, and then output it as '?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
If you use prepared statements, there is no need to do this. There is nothing unsafe about having a value like "D'Alejandro" in a database column.
SQL injection problems arise when SQL statements are built by interpolating user-supplied values into the statement text. There is no reason any modern web application should do this.