4 ms·
The examples are very outdated. In PHP you would convert the offending characters to html entities >at input, yes..input<. It then only needs filtered >one time
by emayljames 7y ago
The examples are very outdated. In PHP you would convert the offending characters to html entities >at input, yes..input<. It then only needs filtered >one time<.
- function_seven 7y agoSo the SMS message I send from my service would look like this? Alert: Bob & Jane O'Brien just commented on your recent post If you store HTML in your database, now you have to convert from that to whatever you're outputting to later. And you haven't covered the dangerous characters for other contexts. Just store whatever the user sent you. When outputting to various formats, convert accordingly.
- emayljames 7y agoThis whole article is based on a DB row being used for everything. That is just not reality. From a cost point of view, if you're gonna just use that data a couple of ways, it is pointless to constantly convert it coming out. Even then, if that was the case, convert from entities, no more costly than what you are saying.