htmlspecialchars makes stuff safe?

[LanceT]

Do you think using the htmlspecialchars function makes user input safe for the mysql database?

 

If not, what other exploits are there? Do I really need to add more to make my user input secure?

[marcus]

htmlspecialchars will replace certain characters into their ASCII form.

 

For example:

 

A < will be replaced as <

A > will be replaced as >

 

The safest way (in my opinion) would to use mysql_real_escape_string() before you enter information into your database.

[Hughesy1986]

If you are just looking to remove the html then strip_tags is the best option as you can allow certain tags aswell.

 

<?php

$var = "<script type='text/javascript'>window.location(http://www.ebay.co.uk)</script><b>Hi</b>";

$var = strip_tags($var, '<b>');

echo $var;

?>