htmlspecialchars and htmlspecialchars_decode

[master82]

Just a quick question...

 

If I use htmlspecialchars on a user text input before storing into a database, then when showing the data in an output use htmlspecialchars_decode before displaying, would that allow potentially harmful code to be run? (ie is it only a good way to store the data not display it?)

[per1os]

What type of potentially harmful code are you trying to prevent?

 

SQL Injection, XSS Exploits ???

 

If you are only worried about sql injection  www.php.net/mysql_real_escape_string works.

 

If you are worried about XSS, I am sure it will, if you have not done so try storing this and dispalying it on the page:

 

$xss = "<script>alert('XSStest');</script>";

 

If you can see the alert display on the page, than it is not preventing any type of XSS exploit.

[master82]

Thanks, I dont know any JS so didnt know how to test these things...