Saving html to mysql what's the best practice?

[Presto-X]

Hello everyone,

 

I would like to know what the best practice for cleaning up and saving mixed text and html like that of a blog post, this is getting submitted via POST from a textarea.

 

And should I be using longblob or longtext as my type or does it matter?

 

Should I be cleaning up the posted information before submitting it to the database?

[Garethp]

I use varchar.

 

And yes, you should, it's easy.

 

$Variabletocleanup = mysql_real_escape_string($Variabletocleanup);

[cags]

You will need to be carefull if you plan to allow HTML, that you don't leave yourself open to XSS attacks. One of the main reasons bbcode style tags are so popular is because it makes life easier when it comes to sanitizing data. Some people remove unwanted tags before entering into the database, wheras I've read a lot of articles recommending doing it before output from the database. The main advantage being if you decided to allow tags that weren't originally allowed, anybody that already used them will automatically gain the benefit in their past posts. You can use strip_tags along with the second parameter to allow specific tags. Personally I prefer to use htmlentities and bbcode tags for allowed tags.