PHP Filter Input Escape Output

Question

Will it be better if i add to mysql_real_escape_string also addslashes like that:

$username = mysql_real_escape_string(trim(addslashes($_POST['username'])));

And is there any need in this in password var:

$password = md5(mysql_real_escape_string(trim($_POST['password'])));

Also i read some topics about safe retrieving data from db... it says that it would be better to retrieve data like that:

htmlentities(stripslashes($v))

Is it really necessary for safety?

Answer 1

Get rid of the addslashes, that's what mysql_real_escape_string() is for!

No need to escape password really either if it's going to be hashed. Though don't use MD5, wait, I'm not opening up that can of worms.

Answer 2

• No, don't use addslashes. It does not make the string more secure or better in any way, but adds complexity.
• Escape the string you want to store in the database. So instead of md5(mysql_real_escape_string($password)), do mysql_real_escape_string(md5($password)).
• Think about allowing spaces at the start and end of passwords, thus not trimming them.
• Use a salt when storing a password, for securities sake.

Answer 3

No need to use addslashes if you use mysql_real_escape_string

Also, no need to strip the slashes when retrieving data from the DB if you sanitised the input before entering it in the DB.

Personally I use HTML purifier to sanitise the input.

md5 is probably not the best solution either, use something like sha-128

Answer 4

Is it really necessary for safety?

-Yes.

You sanitize the data on the way into the database (with mysql_real_escape_string) to prevent accidental data corruption, or intentional sql-injection.

You escape the data on the way out (with htmlentities) to prevent cross site scripting (xss).

Both are very different, and very important.