清理select，radio，checkbox中的值？

Question

Does a select input (or a checkbox or a radio) need to be sanitized and / or escaped, assuming that the value will be used in a query? And if yes, why? I mean, how that value could be altered by someone?

Answer 1

Yes, you should always sanitize all input. Just because you're giving the user a choice from a select, radio, or checkbox, doesn't mean they can't use the web inspector to change the values they can choose from. Also, they can always manufacture their own GET or POST request to send whatever values they want.