StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
17166958
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
0
CommunityOwnedDate
CreationDate
2013-06-18T10:47:05.663
FavoriteCount
0
LastActivityDate
2013-06-18T11:01:23.930
LastEditDate
2017-05-23T10:28:31.123
LastEditorUserId
-1
OwnerUserId
568785
ParentId
17166905
PostTypeId
2
Score
0
ViewCount
0
LastEditorDisplayName
text
Body
No <code>mysql_real_escape_string()</code>! You should use <a href="http://php.net/pdo" rel="nofollow noreferrer">PDO</a>. It uses prepared statements, which will not be vulnerable to injection attacks because MySQL is given the unparameterized SQL first and then given the data to plug in. For example: <pre><code>$dbh = new PDO(); $stmt = $dbh->prepare('INSERT INTO data (something) VALUE(:userInput)'); // No mysql_real_escape_string necessary $stmt->execute(array( ':userInput' => $_POST['userInput'] )); </code></pre> <code>htmlspecialchars()</code> shouldn't be used on all input, but it should be used! Although typically applied after data is retrieved from the db (although, it might be a good idea to do it before in case it is forgotten afterward), it is useful for user input that you will be echoing into your HTML pages. It protects you against XSS (Cross Site Scripting) attacks, in which a malicious user can add <code><script></code> tags that contain malicious code into an input field on your site. When other users visit the page on which this malicious user posted, their browser will interpret the evil scripting, which could do things such as steal session ids or attempt CSRF (Cross Site Request Forgery). Bottom line: You should use it before echoing any user content to your pages. Unless that content has been validated by a rigorous filter (like one for birthdates which only accepts mm/dd/yy). If you're unsure, then use it anyways. It won't hurt. It will only help! Further Reading: <ul> <li><a href="https://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php/60496#60496">How can I prevent SQL injection in PHP?</a></li> <li><a href="https://stackoverflow.com/questions/2905886/what-makes-an-input-vulnerable-to-xss">What makes an input vulnerable to XSS?</a></li> </ul>
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POShould I use htmlspecialchars or mysql_real_escape_string or both
 singulars
 PostTypePostTypeId
 PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. USCommunity
UserOwnerUserId
1. USBailey Parker
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. This table or related slice is empty.

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.