Comment on The curiosity killed the catComments−ars17y"We took the approach to htmlspecialchars() every single GET/POST variable even before processing them."Didn't PHP magic_quotes prove that that is a really bad idea?−sucuri217yPHP magic_quotes proved that doing that by default for every application is a bad idea. Plus, lots of developers weren't even aware of that...In the case of our specific tools (with some limited user input), it worked great.
Comments
"We took the approach to htmlspecialchars() every single GET/POST variable even before processing them."
Didn't PHP magic_quotes prove that that is a really bad idea?
PHP magic_quotes proved that doing that by default for every application is a bad idea. Plus, lots of developers weren't even aware of that...
In the case of our specific tools (with some limited user input), it worked great.