Storing Special Characters in DB

[Omzy]

Just a quick question - should the the ampersand (and other special characters) be stored in it's encoded form (e.g. &) in the database, or should it be stored in its 'raw' form and encoded in the script as and when required?

[Omzy]

BUMP.

[Omzy]

Anyone able to help?

[scampbell]

Thats entirely up to you although I tend to store it in its raw state as it can be manipulated easier.

 

Then just use htmlentities or whatever to output it to the browser when you need to.

[Psycho]

I agree with what scampbell stated, always store data in it's raw format, then manipulate the data based upon how you plan to display it. That does NOT mean you should run database queries with unescaped (i.e. unclean data). You should always use mysql_real_escape_string() on all user submitted data (POST, GET, COOKIE, etc.). Then, when you retieve the values determine how the values should be used for display.

 

For example, if you are going to display the values on the HTML page, then you may want to use htmlentities() to prevent the data from wreaking havoc on the display of the page. However, if you are populating a textarea for the user to edit the content you would want to display the data in (mostly) it's raw format and use htmlspecialchars().

 

Those are only suggestions. You would have to determine what is right for your specific situation.