CODEWITHSUNDEEP
phpmysqlescaping
Dev Newb
Dev Newb

Reputation: 565

gameplan for escaping php MySQL content

Ive read every post here on escaping and unfortunately almost every one has disagreements amongst posters so I just want to ask the community about my specific situation before I make a major mistake because I misunderstood another post.

I am storing user preferences in a MySQL database where I personally place the information directly into the database myself, not user submitted inputs.

My questions are:

1.) If I am running a PHP query and placing the query result into other PHP code blocks, not as HTML but just as things like other queries, ie(SELECT * from $queryresult) there is no need to escape this correct?

2.) If I am outputting what I stored in the database as html directly from the database do I need to sanitize this output in anyway. My understanding is that sanitization is strictly for user submitted input. Need I really worry about data coming out of database fields I personally populated.

I think I know the answers here after reading but I dont want to leave any room for error on this one.

Upvotes: 0

Views: 99

Answers (1)

Brad
Brad

Reputation: 163272

Question 1 - Escaping data for MySQL queries

No, you must always escape data in your queries, regardless of the source. Data escaping is for the query parser. Even if the data comes from your own code, you must escape it.

Learn to use PDO to avoid this problem.

Question 2 - Escaping data for HTML

If you are outputting data to HTML, you must always escape it with htmlspecialchars() or equivalent. This is so you don't have to worry about bad HTML code, as well as XSS.

Upvotes: 2

Related Questions