If you use htmlspecialchars() when receiving input from the user, like:  $email = htmlspecialchars($_POST['email']);   Should you use a prepared statement if the query is just a SELECT one?
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
13909
When encoding a query string to be sent to a web server - when do you use escape() and when do you use encodeURI() or encodeURIComponent():  Use escape:  escape("% +&amp;=");   OR  use encodeURI() / encodeURIComponent()  encodeURI("http://www.google.com?var1=value1&amp;var2=value2");  encodeURIComponent("var1=value1&amp;var2=value2");
93053
(assume php5) consider  &lt;?php      $foo = 'some words';      //case 1     print "these are $foo";      //case 2     print "these are {$foo}";      //case 3     print 'these are ' . $foo; ?&gt;   Is there much of a difference between 1 and 2?  If not, what about between 1/2 and 3?
117181
Has anyone attempted to decode HTML entities using AMPscript? For example, I have encoded HTML stored in a data extension:  &amp;lt;p&amp;gt;Dave is great!&amp;lt;/p&amp;gt;  I need to use this value in an email but the output is displaying:  &lt;p&gt;Dave is great!&lt;/p&gt;   Can AMPscript, or some other feature of the Marketing Cloud, decode the original value before it's called to the email template? Dave needs his credit.  Dave is great!
1681
When using SQL, are there any benefits of using = in a WHERE clause instead of LIKE?  Without any special operators, LIKE and = are the same, right?
37436
I'm using  to check if a user-provided email address is valid. For example:  $email = $_POST['email']; if ( is_email( $email ) )     // Do something.   To the best of my knowledge, nothing in this function writes info to the database. Should I be sanitizing $email before I pass it to the function?
7357
In SQL Server 2005, are there any disadvantages to making all character fields nvarchar(MAX) rather than specifying a length explicitly, e.g. nvarchar(255)? (Apart from the obvious one that you aren't able to limit the field length at the database level)
22775
Is there a library or acceptable method for sanitizing the input to an html page?  In this case I have a form with just a name, phone number, and email address.    Code must be C#.  For example:  "&lt;script src='bobs.js'&gt;John Doe&lt;/script&gt;" should become "John Doe"
10993
In our place we're split between using mysqli and PDO for stuff like prepared statements and transaction support. Some projects use one, some the other. There is little realistic likelihood of us ever moving to another RDBMS.  I prefer PDO for the single reason that it allows named parameters for prepared statements, and as far as I am aware mysqli does not.  Are there any other pros and cons to choosing one over the other as a standard as we consolidate our projects to use just one approach?
81938
When I use varchar(5) in a INSERT query it means that the attribute in the table will take exactly 5 bytes in memory? (Given that one printable character takes one byte)?
47519
Every time a user posts something containing &lt; or &gt; in a page in my web application, I get this exception thrown.  I don't want to go into the discussion about the smartness of throwing an exception or crashing an entire web application because somebody entered a character in a text box, but I am looking for an elegant way to handle this.  Trapping the exception and showing     An error has occurred please go back and re-type your entire form again, but this time please do not use &lt;   doesn't seem professional enough to me.  Disabling post validation (validateRequest="false") will definitely avoid this error, but it will leave the page vulnerable to a number of attacks.  Ideally: When a post back occurs containing HTML restricted characters, that posted value in the Form collection will be automatically HTML encoded. So the .Text property of my text-box will be something &amp; lt; html &amp; gt;  Is there a way I can do this from a handler?
25709
Let's say I have code like this:  $dbh = new PDO("blahblah");  $stmt = $dbh-&gt;prepare('SELECT * FROM users where username = :username'); $stmt-&gt;execute( array(':username' =&gt; $_REQUEST['username']) );   The PDO documentation says:     The parameters to prepared statements don't need to be quoted; the driver handles it for you.   Is that truly all I need to do to avoid SQL injections?  Is it really that easy?  You can assume MySQL if it makes a difference.  Also, I'm really only curious about the use of prepared statements against SQL injection.  In this context, I don't care about XSS or other possible vulnerabilities.
62599
Possible Duplicate:          I'm using the mysqli extension in PHP and I'm wondering, is there possibly any way to see a prepared query as it will be executed on the server, e.g. The query is something like this  select * from table1 where id = ? and name = ?   but I want to see the query after the values are filled in, like this:  select * from table1 where id = 20 and name = "John"
115935
I have a form with a textarea. Users enter a block of text which is stored in a database.  Occasionally a user will paste text from Word containing smart quotes or emdashes. Those characters appear in the database as: â€“, â€™, â€œ ,â€  What function should I call on the input string to convert smart quotes to regular quotes and emdashes to regular dashes?   I am working in PHP.  Update: Thanks for all of the great responses so far. The page on Joel's site about encodings is very informative:   Some notes on my environment:  The MySQL database is using UTF-8 encoding. Likewise, the HTML pages that display the content are using UTF-8 (Update:) by explicitly setting the meta content-type.  On those pages the smart quotes and emdashes appear as a diamond with question mark.  Solution:  Thanks again for the responses. The solution was twofold:   Make sure the database and HTML files were explicitly set to use UTF-8 encoding. Use htmlspecialchars() instead of htmlentities().
30023
Why would someone use WHERE 1=1 AND &lt;conditions&gt; in a SQL clause (Either SQL obtained through concatenated strings, either view definition)  I've seen somewhere that this would be used to protect against SQL Injection, but it seems very weird.  If there is injection WHERE 1 = 1 AND injected OR 1=1 would have the same result as injected OR 1=1.  Later edit: What about the usage in a view definition?    Thank you for your answers.  Still, I don't understand why would someone use this construction for defining a view, or use it inside a stored procedure.  Take this for example:  CREATE VIEW vTest AS SELECT FROM Table WHERE 1=1 AND table.Field=Value
5230
Here's my attempt at it:  $query = $database-&gt;prepare('SELECT * FROM table WHERE column LIKE "?%"');  $query-&gt;execute(array('value'));  while ($results = $query-&gt;fetch())  {     echo $results['column']; }
91753
In a mysqli prepared statement, a NULL gets turned into '' (in the case of a string) or 0 (in the case of an integer). I would like to store it as a true NULL.  Is there any way of doing this?