I had a horrible thought just now so I typed some html code <blink>hi</blink> into a post, and set the query just to look at that post...
To my horror it was all parsed as html! So if someone had typed some nasty html into a post and waited (and refreshed for several hours) it quite possibly would have done something?
I assume if I use:
$text = htmlentities($rs['pagetext']);
That will be safe?
|