Hi,

I'm building a PHP intranet for my boss. A simple customer, order, quote system. It will be denied access from the Internet and only used by 3 people. I'm not so concerned with security as I am with validation. Javascript is disables on all machines.

The problem I have is this:

1. Employee enters valid data into a form containing any of the following :;[]"' etc.
2. Form $_POSTS this data to a validationAndProcessing.php page, and determines whether the employee entered data or not in to the fields. If they didn't they are redirected back to the data input page and the field they missed out is highlighted in red.
3. htmlspecialchars() is applied to all data being re-populated to the form from what they entered earlier.
4. Form is then resubmitted to validationAndProcessing.php page, if successful data is entered into the database and employee is taken to display data page.

My question is this:

If an employee repeatedly enters no data in step 1, they will keep moving between step 1 and 4 each time having htmlspecialchars() applied to the data.

So that:- &
becomes:- &
becomes:- &
becomes:- &

etc..

How can I stop htmlspecialchars() being applied multiple times to data that is already cleaned?

Thanks, Adam