3 ms·
This stops being fun as soon as you have a user named ‘<script>’
by jahewson 5y ago
This stops being fun as soon as you have a user named ‘<script>’
- brundolf 5y agoAny user-entered string data should be sanitized before it enters the DB anyway
- mustardo 5y agoDon't modify input, sanitise output instead. The user entered <script> you should save that verbatim, but there are many output formats, HTML, SQL, PS (Post Script), XLS etc etc where you need to escape user provided values