HTML encode user input when storing or when displaying

后端 未结 4 1928
一个人的身影
一个人的身影 2020-12-14 00:51

Simple question that keeps bugging me.

Should I HTML encode user input right away and store the encoded contents in the database, or should I store the raw values an

4条回答
  •  野趣味
    野趣味 (楼主)
    2020-12-14 01:15

    Keep in mind that you may need to access the database with something that doesn't understand HTML encoded text (e.g., a reporting tool). I agree that space is a non-issue, but IMHO, putting HTML encoding in the database moves knowledge of your view/front end into the lowest tier in the application, and that is a design mistake.

提交回复
热议问题