>>But they don't escape anything on output (like you should).
I am not sure that I do unless Grocery Crud takes care of it. There is only one place where I output a string directly via HTML scripting that they have entered w/o Grocery Crud. It is where they enter the name of their project. I guess I should be checking to make sure that the name of the project is not dangerous. How do I do this? I am not sure what you mean by "escape on output"?
proof that an old dog can learn new tricks
