我是否需要在所有表单输入上使用mysql_real_escape_string？

Question

I know I need to use them on user input fields such as a username entry field, but what about for radio buttons such as a gender option?

Answer 1

Stop!

You seem to be confusing escaping with data validation and data sanitization.

You need to validate any data that comes in. Yes, this means making sure that radio buttons contain legal values.

You need to sanitize any data that comes in. Should that text field contain HTML? No? strip_tags. Should that field be a number? Cast it as an integer.

You need to escape any data that you place in the database. If you're still using the prehistoric "mysql" extension, this means using mysql_real_escape_string on everything as you build your query -- not before.

You need to escape any data you echo to the user. htmlspecialchars is your friend.

I've previously explained this in more detail, though this is not a duplicate question.