"We took the approach to htmlspecialchars() every single GET/POST variable even ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

ars on Aug 11, 2009 | parent | context | favorite | on: The curiosity killed the cat

"We took the approach to htmlspecialchars() every single GET/POST variable even before processing them."

Didn't PHP magic_quotes prove that that is a really bad idea?

sucuri2 on Aug 11, 2009 [–]

PHP magic_quotes proved that doing that by default for every application is a bad idea. Plus, lots of developers weren't even aware of that...

In the case of our specific tools (with some limited user input), it worked great.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact