安全地向MySQL插入数据和从MySQL检索数据

Question

Well, I want to know some tips about PHP and MySQL.

When I get data from user then I use the following validation:

mysql_real_escape_string()
or
htmlentities()
or
trim()

Is it a secure way to get data from the user?

And what is the best way to retrieve data from Mysql database? I used nl2br(), but if i submit I'm here Then it shows I\'m here. It should be showing I'm here. I don't know what the correct method is.

Answer 1

When inserting data into a database, you'll use mysql_real_escape_string; not htmlentities. Or even better, MySQLi - or even better, PDO.

When you're outputting data from the database that might not be secure, you'll probably use htmlentities then.

To stop the slashes, turn magic quotes off.