T
Instead of avoiding < and > you could convert them at reading time (remember the INSERT is better to keep the original as it was written), so at the time you use SELECT the < and > will be converted to < and >, thus avoiding injecting HTML into the page, but can keep the text as close as the author wrote.Another thing you should prevent not only HTML "injection", but also mysql "injection" (or syntax failures), use mysql_real_escape$autor_id = mysql_real_escape($_POST["autor_id"]);
$texto = mysql_real_escape($_POST["texto"]);
$query = "INSERT INTO `videos` ( `autor_id` , `texto`, `id` ) VALUES ('$autor_id', '$texto', '')";
mysql_query($query,$conexao);
In reading use htmlspecialchars, example:$query = 'SELECT autor_id, id, texto FROM videos LIMIT 30';
$consulta = mysql_query($query, $conexao);
while ($linha = mysql_fetch_assoc($consulta)) {
echo 'texto: ', htmlspecialchars($linha['texto']), '<br>';
}
Old Mysql Api for PHP vs PDO and MysqliAs has been said a few times in SOpt: https://pt.stackoverflow.com/q/74851/3635 https://pt.stackoverflow.com/q/47880/3635 The php API mysql_ will be discontinued (Does not mean that mysql will be discontinued, only the PHP API) because it has been replaced by mysqli_*, then it is highly recommended that you update your codes to use or mysqli or pdoAdvantages of mysqliGuidance interface there are objects (Object-oriented interface)Support for Prepared StatementsSupport for multiple StatementsTransaction Support (Transactions)Improved debugging capabilityEmbedded server supportAdvantages of PDOHow it was said by https://pt.stackoverflow.com/a/8338/3635 :Advantages:Works with 12 different database drivers (4D, MS SQL Server, Firebird/Interbase, MySQL, Oracle, ODBC/DB2, PostgreSQL, SQLite, Informix, IBM, CUBRID);API Guided to objects;It has named parameters;Has prepared statements from the client side (see disadvantages below)Disadvantages:Not as fast as MySQLi;By default, it simulates statements prepared (you can activate the native version by configuring its connection to the bank, but if the native version doesn't work for some reason, it again simulates the prepared statements without firing errors or warnings. https://stackoverflow.com/questions/7919645/can-i-use-real-prepared-statements-for-mysql-with-pdo-now )Why update your codesLike I said in this https://pt.stackoverflow.com/a/66489/3635 , it must be noted that the functions mysql_ no longer receive updates such as fixes and improvements and this is the vital point for you not to use more mysql_, because in the future soon it will no longer exist for the new versions of PHP.In other words, if you continue to function mysql_ (without the i), two situations can happen with your projects:There may be failures in API security mysql_ or bugs.When the API mysql_ is disabled, your scripts will stop working, which will cause you a lot of headache as you will have to redo multiple codes.How to use mysqli with your codeThe insertion can be like this:$autor_id = mysqli_real_escape_string($_POST["autor_id"]);
$texto = mysqli_real_escape_string($_POST["texto"]);
$query = "INSERT INTO videos ( autor_id , texto, id ) VALUES ('$autor_id', '$texto', '')";
mysqli_query($query,$conexao);
In reading use htmlspecialchars, example:$query = 'SELECT autor_id, id, texto FROM videos LIMIT 30';
$consulta = mysqli_query($query, $conexao);
while ($linha = mysqli_fetch_assoc($consulta)) {
echo 'texto: ', htmlspecialchars($linha['texto']), '<br>';
}
However you can use the prepared statements, so you will not need to use mysqli_real_escape_string, example of data entry: <?php
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit;
}
$autor_id = $_POST["autor_id"];
$texto = $_POST["texto"];
if ($stmt = $mysqli->prepare("INSERT INTO `videos` ( `autor_id` , `texto`, `id` ) VALUES (?, ?, '')")) {
$stmt->bind_param('i', $autor_id);
$stmt->bind_param('s', $texto);
$stmt->execute();
while ($linha = $result->fetch_assoc()) {
echo 'texto: ', htmlspecialchars($linha['texto']), '<br>';
}
$stmt->close();
}
$mysqli->close();
Documentation: http://php.net/manual/en/book.mysqli.php http://php.net/manual/en/class.pdo.php
