Make sure that your data is passed through process_db_input function or is saved using forms

[AlexT]

Make sure that your any data is passed through process_db_input function using the way described below, or is saved using forms

---

As the result use the following sample code:

$sVal = $_REQUEST['some_value']; // just for example, it shows that $sVal comes from browser

1. $sVal is not a string but a number:

   $iVal = (int)$sVal;
   //or
   $iVal = (float)$sVal;
   

2. $sVal has html code and you need to save this html code (for example you have tinymce area).

   $sVal = process_db_input($sVal, BX_TAGS_VALIDATE);
   

3. $sVal has html code and you need to get rid of all tags:

   $sVal = process_db_input($sVal, BX_TAGS_STRIP);
   

4. $sVal has html code and you need to translate it to htmlchars to display the code (not recommended, it is better to use this way when you want to display saved data to user):

   $sVal = process_db_input($sVal, BX_TAGS_SPECIAL_CHARS);
   

---

no additional stripslashes or addslashes !!!! only above code

[AlexP]

Done for Sites, Profile Customizer, Tags, Categories

[AlexL]

Done for flash (Ray) components

[AndreyP]

Done for blogs / ads / custom RSS

[LeonidS]

Done for albums & files modules

[AntonL]

Done for: Articles
Feedback
News
Payment
Membership
Wall

[AlexT]

Done: Avatar, Events, Google Site Search, Groups, World Map, Store, XMLRPC interface

[AlexT]

Done for system files in root folder

[AlexT]

Done for inc/*, inc/classes/* and templates/base/script/*

[sashae]

Done for polls, simple messenger, shoutbox, mailbox