It's just good coding practice to do so. Say for instance you have a moderator or someone whom you allow access to the admin CP (a business partner for instance) and you have a falling out - he/she then injects something nasty theough the AdminCP and BOOM!


Sir Adrian,
ok, i'm learning this, thanks. So after escaping it, if I want to display it in a <textarea> type input box for user to edit it, it's showing as follows:

Which is safe, however for display in the textarea, i want it to display as entered which was like this:

When I display it, I can qet the &quot; to parse correctly, but all the /n/r/n/r i can't get to display correctly. Can you help? Thanks :)

Why are you displaying it after escaping it? It goes into the query escaped, and when you read from the DB again it should be OK.

It goes into query escaped before being put into database. Then if user wants to edit the text, it's displayed again, within the <textarea> box for them to modify.

I'd be fine if the initial cleaning of the data totally stripped out all the /n/r/n/r stuff as well since i have no need for them to post data on new lines. Am i missing something or do i need to create a regex before passing data to the update or save query?

Only escape just before using it in a query. That's all it is for. You should never display it after it has been escaped; that doesn't make sense!

Thanks for your help on this issue SirAdrian.
So you're telling me that somewhere I am escaping it before displaying it in the <textarea> box?

Yeah you must be. Post your code here (or make a new thread in programming / coders discussion and I will take a look).

ok will post it in programming discussions - thanks

Excellent article SirAdrian, was a great read. :)

Definitely. Thank you for taking the time to write this article, Adrian. :up:

Nice article, thanks for taking the time to write this out.