Wednesday, 28 August 2013

Which is better method to prevent XSS?

Which is better method to prevent XSS?

$a_idWhich is better method to prevent XSS attacks? Here is the code I am
trying to do.
Is this line of code enough to prevent XSS attacks? or Do I have to parse
each element with 'strip_tags'. Thank you for any suggestions.
$xss = array_map('strip_tags', $_POST);
OR
I have a lot of form elements to replace with 'strip_tags'.
$f_name = strip_tags($_POST["f-name"]);
$a_id = isset($_POST['a_id']) ? (int)strip_tags($secure_POST['a_id']) : 0;
$qry = $pdo_conn->prepare('INSERT INTO TABLE1(id, f_name) VALUES (?, ?)');
$qry->execute(array($a_id, $f_name));

No comments:

Post a Comment