PHP exit help

Question

The code -

$price = mysqli_real_escape_string($connect,trim($results['price']));

the price is retrieved from the database and then repeated using -

echo $price; 

Question. How safe is it for XSS or SQL Injection? It just includes numbers.

thank

Answer 1

Validation should probably be performed during data entry, but you can be safe and also validate on exit. I would just use is_numericor something similar to ensure that the output is really a number.

Answer 2

htmlspecialchars() htmlentities() XSS. , , , . .

Answer 3

, , $results['price'] .

/ SQL.

Answer 4

db, mysqli_real_escape_string(). , db.

Answer 5

mysqli_real_escape_string() , , SQL. XSS.

htmlentities(), , . is_numeric .