Sanitize user-input when using in Mysql Query.
You can use real_escape_string of mysqli.
For Example:
Sanitize user-input while insert in database and displaying in Browser.
You can use htmlentities and html_entity_decode.
For Example:
Sanitize user-input when using in Command Prompt.
You can use escapeshellarg.
For Example:
You can use real_escape_string of mysqli.
For Example:
$mysqliObj = new mysqli("localhost", "root", "", "mydb"); $city = $mysqliObj->real_escape_string($_POST['city']); if ($mysqli->query("INSERT into myCity (Name) VALUES ('$city')")) { printf("%d Row inserted.\n", $mysqli->affected_rows); }
Sanitize user-input while insert in database and displaying in Browser.
You can use htmlentities and html_entity_decode.
For Example:
echo htmlentities($data['description']);//at the time of insert in database echo html_entity_decode($data['description']); //at the time of display in browser from database
Sanitize user-input when using in Command Prompt.
You can use escapeshellarg.
For Example:
system('ls '.escapeshellarg($data['dir']));