Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #14844
| From | Jerry Stuckle <jstucklex@attglobal.net> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: Stripslashes v. strip_tags |
| Date | 2015-01-30 10:13 -0500 |
| Organization | A noiseless patient Spider |
| Message-ID | <mag712$bsg$1@dont-email.me> (permalink) |
| References | <1lz25q5.19rg1lzdxnqfiN%adrian@poppyrecords.invalid.invalid> |
On 1/30/2015 5:48 AM, Adrian Tuddenham wrote: > To prevent code being injected with data in POST or GET, it appears that > either stripslashes() or strip_tags() can be used to 'clean' the data. > > What are the relative advantages of each these two functions? > > Is there a case for preferring one to the other, or should both be used > to cover all possibilities? > Neither is going to prevent code injection. stripslashes() is outdated - it was used with magic_quotes_gpc, which never was a good idea and is gone. strip_tags() is meant to remove html tags, i.e. when parsing html code in a page. What you need to do is validate every parameter you expect from the page, ensuring it is of the correct type and has a valid value. There is no shortcut. -- ================== Remove the "x" from my email address Jerry Stuckle jstucklex@attglobal.net ==================
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Stripslashes v. strip_tags adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2015-01-30 10:48 +0000
Re: Stripslashes v. strip_tags Jerry Stuckle <jstucklex@attglobal.net> - 2015-01-30 10:13 -0500
Re: Stripslashes v. strip_tags Tim Streater <timstreater@greenbee.net> - 2015-01-30 17:12 +0000
Re: Stripslashes v. strip_tags maria.adroit7786@gmail.com - 2015-02-02 06:31 -0800
csiph-web