in reply to Re: Prevent SQL Injection
in thread Prevent SQL Injection

Hi,

I've been updating my programs to use only place holders. I'm now looking at the next step.

"When you're outputting it as HTML, then HTML-encode it."

My question is naive but could you provide a couple of examples in order to clearly define what is meant by HTML-encode and in these examples show how one is handling any insecurities or difficult to display characters (I presuppose the single and dbl quote)

Thank-you
David J.