Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

3
  • 2
    Never further post-process any strings after they've gone through mysql_real_escape_string! SQL escaping is always the last thing you do before plugging the value into a query, and is pointless at best in any other circumstance. Commented Mar 3, 2011 at 1:43
  • You shouldn't escape the HTML when putting it into the database. It makes more sense to escape it for display; right before you print the HTML. Commented Mar 3, 2011 at 2:04
  • @Jonathan Let me point out that this is not a good solution. You should not store HTML-escaped strings in your database. It is not necessary to avoid SQL injection, and it's bad practice. You should escape your strings according to the output medium. I.e., HTML escaping is only necessary when putting the strings into an HTML document, so only do it then. If you decide to output the values anywhere else, say in a JSON context, you've just dug yourself into a hole by "hard coding" your content for output into HTML. Commented Mar 3, 2011 at 2:07