Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <blockquote> <ul> <li><code>mysql_real_escape_string</code> used when insert into database </li> <li><code>htmlentities()</code> used when outputting data into webpage</li> <li><code>htmlspecialchars()</code> used when?</li> <li><code>strip_tags()</code> used when?</li> <li><code>addslashes()</code> used when?</li> </ul> </blockquote> <h3>htmlspecialchars() used when?</h3> <p><code>htmlspecialchars</code> is roughly the same as <code>htmlentities</code>. The difference: character encodings.</p> <p>Both encode control characters like <code>&lt;</code>, <code>&gt;</code>, <code>&amp;</code> and so on used for opening tags etc. <code>htmlentities</code> also encode chars from other languages like umlauts, euro-symbols and such. If your websites are UTF, use <code>htmlspecialchars()</code>, otherwise use <code>htmlentities()</code>.</p> <h3>strip_tags() used when?</h3> <p><code>htmlspecialchars</code> / <code>entities</code> encode the special chars, so they're <em>displayed but not interpreted</em>. <code>strip_tags</code> REMOVES them. </p> <p>In practice, it depends on what you need to do.</p> <p>An example: you've coded a forum, and give users a text field so they can post stuff. Malicious ones just try:</p> <pre><code>pictures of &lt;a href="javascript:void(window.setInterval(function () {window.open('http://evil.com');}, 1000));"&gt;kittens&lt;/a&gt; here </code></pre> <p>If you don't do anything, the link will be displayed and a victim that clicks on the link gets lots of pop-ups.</p> <p>If you htmlentity/htmlspecialchar your output, the text will be there as-is. If you strip_tag it, it simply removes the tags and displays it:</p> <pre><code>pictures of kittens here </code></pre> <p>Sometimes you may want a mixture, leave some tags in there, like <code>&lt;b&gt;</code> (<code>strip_tags</code> can leave certain tags in there). This is unsafe too, so better use some full blown library against XSS.</p> <h3>addslashes</h3> <p>To quote an <a href="https://web.archive.org/web/20100525131537/http://php.net/manual/en/function.addslashes.php" rel="nofollow noreferrer">old version of the PHP manual</a>:</p> <blockquote> <p>Returns a string with backslashes before characters that need to be quoted in database queries etc. These characters are single quote ('), double quote ("), backslash () and NUL (the <strong>NULL</strong> byte).</p> <p>An example use of <strong>addslashes()</strong> is when you're entering data into a database. For example, to insert the name <em>O'reilly</em> into a database, you will need to escape it. It's highly recommeneded to use DBMS specific escape function (e.g. mysqli_real_escape_string() for MySQL or pg_escape_string() for PostgreSQL), but if the DBMS you're using does't have an escape function and the DBMS uses \ to escape special chars, you can use this function.</p> </blockquote> <p>The <a href="http://php.net/addslashes" rel="nofollow noreferrer">current version</a> is worded differently.</p>
    singulars
    1. This table or related slice is empty.
    1. POHow to prevent code injection attacks in PHP?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USstefs
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POHow to prevent code injection attacks in PHP?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload