HTML CHARACTER ESCAPE

Hey. What is the best practice to escape html special characters when saving user input in database and works for the majority of the servers out there? I used mysql_real_escape_string and seems to fail under some servers. Also htmlentities fails. Keep in mind that i will need to use the data after i insert it Thanks

mysql_real_escape_string is the best way to do it if you are writing raw SQL queries. The question is, why aren’t you using a database abstraction layer? You can use an ORM wth a DBAL built-in, like Propel or Doctrine, or just the DBAL like ADODB . These libraries will have escaping logic built in that will wrap PHP native methods and handle failures as well.

I want to use it in a wordpress template so that is why i need it to be general. I cannot choose what every of our customers use as a database engine.

duotive said
I want to use it in a wordpress template so that is why i need it to be general. I cannot choose what every of our customers use as a database engine.

http://codex.wordpress.org/Function_Reference/esc_attr

Thanks. Will give it a try.

duotive said
Thanks. Will give it a try.

this is probably a better read http://codex.wordpress.org/Data_Validation

duotive said
I want to use it in a wordpress template so that is why i need it to be general. I cannot choose what every of our customers use as a database engine.

Then you should use WordPress database object (wpdb). They handle escaping for you, and you don’t have to open a second db connection.