PHP and mySql

[atholon]

Well I was chatting with some folks from phpfreaks.com.

They confirmed some good practices to protect your website.

1. Filter all content entered into the database
2. Escape all content comming from the database.


So you can use mysql_real_escape_string() and stripslashes() to remove stuff that can mess up the query.

Then you use htmlentities() to prevent users from entering php or other scripting languages and having that be executed.

Html entities basically takes the strings and converts the characters into html code.

If you use htmlentities when adding content to the mysql table and decide later on to crop the text at a certain length, it will expose the html code because it will crop that too.

Hope this helps someone starting out.

[IcIshoot]

Depending on your data, and what your wanting to do with it, encoding the data to base64 also works