Should htmlspecialchars() be used on information on input or just before output?

后端 未结 2 1954
闹比i
闹比i 2020-12-21 04:13

I take $_POST information and store it in a DB and later on query and print this information to the user. Should I use htmlspecialchars() before inserting this info or after

2条回答
  •  忘掉有多难
    2020-12-21 05:01

    htmlspecialchars() is used before output to avoid XSS. And the database should better save the user's raw input.

提交回复
热议问题