http://www.edwardyarnold.co.uk/blog/when-to-sanitise-data PHP & MySQL Web Developer Fri, 23 Sep 2011 18:42:05 +0000 hourly 1 http://wordpress.org/?v=3.2.1 http://www.edwardyarnold.co.uk/blog/when-to-sanitise-data/comment-page-1#comment-32 Ed Yarnold Mon, 26 Apr 2010 10:14:47 +0000 http://www.edwardyarnold.co.uk/blog/?p=85#comment-32 Can't believe I missed that point, Tom! I had that very situation a few weeks ago. A site had been built where all data was htmlentitied. We wanted to export a stock list to PDF but had to unhtmlentity everything first. Not a pretty solution, and it could have been avoided with a bit of foresightedness! Can’t believe I missed that point, Tom! I had that very situation a few weeks ago. A site had been built where all data was htmlentitied. We wanted to export a stock list to PDF but had to unhtmlentity everything first. Not a pretty solution, and it could have been avoided with a bit of foresightedness!

]]> http://www.edwardyarnold.co.uk/blog/when-to-sanitise-data/comment-page-1#comment-28 Tom Sat, 24 Apr 2010 23:12:31 +0000 http://www.edwardyarnold.co.uk/blog/?p=85#comment-28 In my mind it's clear - always perform data filtering on output. Why? Because it offers more flexibilty. Sure, you may just be displaying data on a web page for now, but if you want to be more creative in future (e.g. export to Excel or PDF) you'll likely not want special characters escaped to HTML entities and the like. In my mind it’s clear – always perform data filtering on output. Why? Because it offers more flexibilty. Sure, you may just be displaying data on a web page for now, but if you want to be more creative in future (e.g. export to Excel or PDF) you’ll likely not want special characters escaped to HTML entities and the like.

]]>