php - mysql_real_escape_string and html_special_chars enough? -

php - mysql_real_escape_string and html_special_chars enough? -

this question gets asked lot, still haven't found straight reply on stackoverflow. these 2 functions sufficient or not? there lot of contradictory comments around net "yes fine?, "no, never utilize it". others say, utilize pdo, don't understand. i'm beginner php, don't understand of ins , outs of security. i've tried reading , understanding following, many don't create much sense me.

http://ha.ckers.org/xss.html do htmlspecialchars , mysql_real_escape_string maintain php code safe injection?

what if utilize preg_replace strip unwanted characters?

i'm incredibly confused , don't know start.

edit: please recommend how go understanding prepared statements (assuming best option).

sam, if storing input in database, avoid sql injection , xss 2 functions enough. if storing passwords, must encrypt passwords one-way encryption (that can not decrypted).

let me expand answer: first of all, sql injection method malicious user effort modify sql statement create will. example, let's have login form. inserting 1 of next values un-protected form, able log first business relationship without knowing username or password:

' or 1=1 --

there many versions of above injection. let's examine sql executed on database:

the php: mysql_query("select * users username='" . $username."' , password='" . $password . "';");

when above executed, next sql sent database:

select * users username='' or 1=1-- ' , password='' or 1=1--';

the effective part of sql this: select * users username='' or 1=1

as double dash (with space afterwards) comment, removing rest of statement.

now gives malicious user access. utilize of escaping function such mysql_real_escape_string, can escape content next sent database:

select * users username='\' or 1=1-- ' , password='\' or 1=1--';

that escapes quotes, making intended strings, - strings.

now let's view xss. malicious user alter layout of page. known xss attack facespace attack on facebook in 2005. involves inserting raw html forms. database save raw html , displayed users. malicious user insert javascript utilize of script tag, javascript can do!

this escaped converting < , > <l; , > respectively. utilize html_special_chars function this.

this should plenty secure normal content on site. passwords different story.

for passwords, must encrypt password. advisable utilize php's crypt function this.

however, 1 time password encrypted , saved in database encypted password, how can decrypt check correct? easy reply - don't decrypt it. hint: password encrypts same value.

were thinking 'we can encrypt password when user logs in , check against 1 in database', correct...

php security sql-injection code-injection