Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have a database sanitizing function that I use when the user enters some data into my website. I escaping the mysqli characters with mysqli_real_escape_string(), but I wish to also output the content with htmlspecialchars(). The problem is, let's just say the user enters something with a single quote; that will be escaped by the sanitize function and will be output as \'. Is there any way to store it like that, and then output it as '?

share|improve this question
    
A: don't 'escape' inputs, use prepared statements. B: sanitize at the earliest possible time, 'escape' (if you really, really have to) at the lastest possible time. –  Javier May 17 '13 at 15:16

1 Answer 1

I have a database sanitizing function that I use when the user enters some data into my website.

If you use prepared statements, there is no need to do this. There is nothing unsafe about having a value like "D'Alejandro" in a database column.

SQL injection problems arise when SQL statements are built by interpolating user-supplied values into the statement text. There is no reason any modern web application should do this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.