htmlspecialchars help

[Stephen68]

I came across a function that cleans up form information for query's, it uses htmlspecialchars(). Now when I go to display the entree

from the database the " and what not are messed up. So to fix this I used htmlspecialchars_decode(), and so far it works but

I was wondering if this is the proper way to do this kind of thing.

 

Here is the function I use to clean up form information.

 

function clean($text) {
$text=strip_tags(trim(htmlspecialchars(mysql_real_escape_string($text))));
return htmlspecialchars($text);
}

 

Thanks for your advice and help guys

 

Stephen

[thebadbad]

Only run mysql_real_escape_string() (and strip_tags(), if you want to remove potential tags) on a string before inserting it to the database.

 

Then when you display the data on your pages, run it through htmlentities() or htmlspecialchars() to prevent the data from being interpreted as (X)HTML.

 

And didn't you notice your function applies htmlspecialchars() twice?

[Stephen68]

ya I see that now, I'm not sure where I came across that but maybe I'll have to modify it a little.

Thanks for your help!

 

Stephen