htmlspecialchars_uni missing single quote

[Gizmo99]

Morning

bit of a sqiffy one for you

I use

PHP Code:

$vbulletin->input->clean_array_gpc('p', array(
'mileage'       => TYPE_NOHTML
)); 


BUT

mileage =70'000 is allowed through ???????? and hence a sql error ?????

Giz

[Marco van Herwaarden]

TYPE_NOHTML does not do a html_specialchars_uni IIRC.

[Gizmo99]

emmm not good then

[Marco van Herwaarden]

Why not good? It is an input cleaner class, not an output cleaner.

You should always (as close to the query in which you will be using it) prepair non-numeric data for use in MySQL.