Should I sanitize EVERY form variable passed along?
- by Camran
I have a form with many fields...
The action is set to a php page which queries mysql...
Should I sanitize with mysql_real_escape_string every single variable?
Or can I ignore sanitizing drop-lists and radios for instance?
Also, besides mysql_real_escape_string, what else should I do to prevent attacks?
Thanks