escape html-entities

[eluser]drewbee[/eluser]
I agree with this practice completely. I do not like touching user data going in, but fixing it on the way out. If you change it on the way in, it makes it that much harder to track and debug.

Also, the following scenario may offer advice on why you would do this.

Lets say you have a database column VARCHAR with a maxlength of 10.

Now lets say through a form the user inputs the following: 'go>to>here'

So the above is 10 characters correct? Nope. Not after escaping it.

What would be inserted into the database is 'go>to>' at its 10 character limit, obviously ommiting a very important section of the string.

Hope this helps...