mercredi 23 août 2017

Sanitizing data PHP - do i need to escape user inputs that are inside if statements?

I'm sanitizing all user inputs that are output on page, e.g.:

echo escape($user_input);

I have a question about user inputs that are not output to the page but are inside statements - do they need escaped?

Is this OK:

if ($user_input == 'something') { echo escape($another_user_input); }

or should it be:

if (escape($user_input) == 'something') { echo escape($another_user_input); }

Same question for other logic (foreach loops etc.) which would add more faff than this simple example.

Aucun commentaire:

Enregistrer un commentaire