Hướng dẫn does mysql_real_escape_string prevent xss?
I want to know how to prevent HTML injection. I have created a site where users are allowed to paste articles in a HTML form. I have used
Gumbo 627k106 gold badges766 silver badges836 bronze badges asked Jul 30, 2011 at 13:12
3 No, Both HTML injection and XSS happen in different contexts where there are different contextual special characters that need to be taken care of. In HTML it’s especially
answered Jul 30, 2011 at 13:32
GumboGumbo 627k106 gold badges766 silver badges836 bronze badges You should use prepared statements to be absolutely sure to prevent sql injection. Taken from documentation (read the part in bold)
If you meant to prevent XSS (Cross site scripting) you should use the function htmlspecialchars() whenever you want to output something to the browser that came from user input or from any non secure source. Always treat any unknown source as unsecure
Gumbo 627k106 gold badges766 silver badges836 bronze badges answered Jul 30, 2011 at 13:16
Nicola PeluchettiNicola Peluchetti 75k30 gold badges137 silver badges189 bronze badges 3 No. In fact, I believe
that for advanced coders, you shouldn't be using answered Jul 30, 2011 at 13:48
Bailey ParkerBailey Parker 15.2k4 gold badges51 silver badges88 bronze badges No, it's not. Refer to the docs It doesn't escape < or >. answered Jul 30, 2011 at 13:15
erenonerenon 18.6k2 gold badges61 silver badges88 bronze badges Simple answer: No mysql_real_escape_string only helps you get rid of SQL Injections and not XSS and html injection. To avoid these you need more sophisticated input validation. Start by looking at strip_tags and htmlentities. answered Jul 30, 2011 at 13:15
JK.JK. 5,0861 gold badge26 silver badges26 bronze badges |