user input security docs?

[Anon]

Hi i need some docs on how to handle user input safely, and efficiently. Anyone have any references that i can utilize? Do i necessarily have to worry about metacharacters, or is it primarily just quotes?

[Anon]

Depends on what you're trying to do with the data.. for database inserts, addslashes() [http://php.net/manual/function.addslashes.php] is most likely what you need, for executing shell commands EscapeShellCmd() [http://php.net/manual/function.escapeshellcmd.php] is what you'll need to use. If you want to escape HTML output for reoutput to webpages, read up on escaping HTML entities use htmlentites() [http://php.net/manual/function.htmlentities.php] or htmlspecialchars() [http://php.net/manual/function.htmlspecialchars.php]. For URL data that you might want to encode use urlencode () [http://php.net/manual/function.urlencode.php]. That's all I can think of at the moment.

[Anon]

Perfect, that's exactly what i was looking for. My primary problem was with db queries, which i was pretty sure addslashes would cover, but wanted to be sure that there wasn't any instances that i hadn't thought of that could break the code. Thanks for your time, you've been most helpful.