Register Globals   Magic Quotes

You should always allow for spurious or unusual user input that may go into forms and databases. Depending on how PHP is configured on the server will affect how you need to manage this, but *always* escape special characters. If magic_quotes are ON, this might have been automatically done for you.

Explore the use and effect of these special characters, such as the ' character in:

Melanie O'Taggarty

or the < > in

<ABC Com Software>

The following is a working example in use from the contact page:

$email=htmlspecialchars(stripslashes($_POST['email']));

The sections to read up on, in conjunction with your
phpinfo() file are:

magic_quotes_gpc
magic_quotes_runtime
magic_quotes_sybase
htmlspecialchars
htmlentities
addslashes
stripslashes

NEXT ::

General tips: