Secure way to insert and retrieve data to and from MySQL

Question

Well, I want to know some tips about PHP and MySQL.

When I get data from user then I use the following validation:

mysql_real_escape_string()
or
htmlentities()
or
trim()

Is it a secure way to get data from the user?

And what is the best way to retrieve data from Mysql database? I used nl2br(), but if i submit I'm here Then it shows I\'m here. It should be showing I'm here. I don't know what the correct method is.

Neither of these functions do validation. And whether it’s safe to use the output of these functions depend on how you use those values. So how do you use these functions? — Gumbo
– Gumbo, Commented Feb 5, 2012 at 16:43
Switch to PDO and please please please turn off magic quotes for the better of humanity. — PeeHaa
– PeeHaa, Commented Feb 5, 2012 at 16:44
@PeeHaa Thanks for this idea. But I think it's already OFF from php 5.0. is it? — user1161867
– user1161867, Commented Feb 5, 2012 at 16:45
@user1161867: No. Well, at least I had to turn it off manually on my installation. That was PHP 5.2.17 on Windows. — Ry-
– Ry- ♦, Commented Feb 5, 2012 at 16:46

Ry- · Accepted Answer · 2012-02-05 16:43:42Z

1

When inserting data into a database, you'll use mysql_real_escape_string; not htmlentities. Or even better, MySQLi - or even better, PDO.

When you're outputting data from the database that might not be secure, you'll probably use htmlentities then.

To stop the slashes, turn magic quotes off.

answered Feb 5, 2012 at 16:43

Ry-♦

226k56 gold badges496 silver badges504 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user1161867 Over a year ago

Thanks @minitech. So htmlentities is secure? Any other method?

Ry- Over a year ago

@user1161867: Yes, it's secure for HTML output. Just remember to use it. Oh, and there's also htmlspecialchars.

Ry- Over a year ago

@user1161867: You can mix them, but it's good to be consistent. And don't use both, things will break :)

Collectives™ on Stack Overflow

Secure way to insert and retrieve data to and from MySQL

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related