is using htmlentities() to sanitize $_posts adequate protection?

[cloudll]

I have never looked into sanitizing before, Is using htmlentities() good enough to protect against sql injection ?

 

Thanks.

[awjudd]

You shouldn't be using htmlentities to prevent SQL injection.  There are other functions to do that for you (i.e. mysql_real_escape_string) or better yet, use database parameters.

 

~juddster

[cloudll]

Ah ok, the only reason I was thinking about htmlentities is because wouldnt it allow me to see what someone was atempting to do? if they did try any injection?

 

would i use it like this:

 

$statement->execute(array mysql_real_escape_string($sector), mysql_real_escape_string ($battle,$id));

 

or am i supposed to use it like this?

 

$name = mysql_real_escape_string($_POST['admin_name']);

[awjudd]

If you are using database parameters for your query there is no need to escape them.

 

Or if you aren't you would do something like what you have at the bottom.

 

~juddster