[Vaupell]

Originally Posted by Dismounted

TYPE_NOHTML should be used when you are not entering data into the database, but displaying it. You should be using TYPE_STR, and use htmlspecialchars_uni() when fetching and displaying the data.

ahh thats how its supposed to be understod.. tx was confused by the article.

Exsample..

- retrive data

PHP Code:

$result = $vbulletin->db->query_read("SELECT someinfo, ...........

// run the array

while ($row = $vbulletin->db->fetch_array($result))
  {
    $Rtitle = htmlspecialchars_uni($row['someinfo'])
  } 


And when reciving it from a user to add to the db
i would do

PHP Code:

    $vbulletin->input->clean_array_gpc('p', array(
        'someinfo'             => TYPE_STR,

$someinfo =& =& htmlspecialchars_uni($vbulletin->GPC['someinfo']);

$db->query_write("INSERT ignore into table someinfo.................. 


does this also secure agains XSS crazy people ?