Cross site scripting defense

[jimmyshoes]

I'm using htmlEditFormat() as a defence against cross site scripting. My question is where should you insert this function. If you are collecting data from a form, uploading it to a table and then later showing the data in the table, is it common practice to run htmlEditFormat() before you insert the data into the database table or is it better to save the data to the database in whatever form it is entered, and then run htmlEditForat() on the variables as they are output to the user during a later search?

Thanks

 

[r937]

if you "save the data to the database in whatever form it is entered" you will eventually get hacked by SQL injection

htmlEditFormat is insufficient, by the way

for example, it won't stop "little bobby tables"

;-)

r937.com | rudy.ca
Buy my new book Simply SQL from Amazon