I'm sanitizing all user inputs that are output on page, e.g.:
echo escape($user_input);
I have a question about user inputs that are not output to the page but are inside statements - do they need escaped?
Is this OK:
if ($user_input == 'something') { echo escape($another_user_input); }
or should it be:
if (escape($user_input) == 'something') { echo escape($another_user_input); }
Same question for other logic (foreach loops etc.) which would add more faff than this simple example.
Aucun commentaire:
Enregistrer un commentaire