3 ms·
Any user-entered string data should be sanitized before it enters the DB anyway
by brundolf 5y ago
Any user-entered string data should be sanitized before it enters the DB anyway
- mustardo 5y agoDon't modify input, sanitise output instead. The user entered <script> you should save that verbatim, but there are many output formats, HTML, SQL, PS (Post Script), XLS etc etc where you need to escape user provided values