Submitting form via Ajax and inserting into DB

Normally, I wouldn’t because I don’t want to strip content that might potentially be meaningful. Of course, it depends on the use case but personally I never do it.

We are talking here about storing data - htmlspecialchars / htmlentities are not meant to be used for storing. It is best to store data as is and use htmlspecialchars / htmlentities when displaying on the page. In such a case striptags is not important for security because any code will just be displayed and not executed.

1 Like