Hello - crossing over from the Dark Side (ASP/Windows) to PHP/NIX.
I have found the PHP Sanitize functions provided by OWASP to be a
useful resource.
First Question:
If I use sanitize_parano id_string or sanitize_system _string, the output
is enclosed within double quotes.
e.g.
<code>
$string = '"'.preg_replac e('/\$/', '\\\$', $string).'"';
//make sure this is only interpretted as ONE argument
</code>
Is there a <em>security</em> reason why this is done? Also, could
someone elaborate on the comment that follows the command, I'm
embarassed to admit, that I'm not sure what it means.
Once, I "sanitize" the data, I don't want it to be enclosed within the
double quotes, so if I do this instead...
<code>
$string = preg_replace('/\$/', '\\\$', $string);
</code>
....is this just as secure? Or should I strip the quotes off afterwards?
T.I.A.
I have found the PHP Sanitize functions provided by OWASP to be a
useful resource.
First Question:
If I use sanitize_parano id_string or sanitize_system _string, the output
is enclosed within double quotes.
e.g.
<code>
$string = '"'.preg_replac e('/\$/', '\\\$', $string).'"';
//make sure this is only interpretted as ONE argument
</code>
Is there a <em>security</em> reason why this is done? Also, could
someone elaborate on the comment that follows the command, I'm
embarassed to admit, that I'm not sure what it means.
Once, I "sanitize" the data, I don't want it to be enclosed within the
double quotes, so if I do this instead...
<code>
$string = preg_replace('/\$/', '\\\$', $string);
</code>
....is this just as secure? Or should I strip the quotes off afterwards?
T.I.A.