Changes between Version 8 and Version 9 of CodingStyle

Timestamp:

Aug 14, 2008, 2:22:39 PM (16 years ago)

Author:

davea

Comment:

--

CodingStyle

@@ -131 +131 @@
 == PHP specific ==
 
+=== HTML ===
+
+It's OK to output HTML rather than XHTML.
+I have yet to hear a convincing reason for the latter,
+and it's more characters.
+
 === Getting POST and GET data ===
-Remember that hackers can pass arbitrary values in POST and GET, and they can use this to do SQL injections and other exploits.
- * Do not access `$_POST` or `$_GET` directly.
- * Use `get_int()`, `get_str()`, `post_int()` and `post_str()` (from `util.inc`) to get POST and GET data.
+
+Do not access `$_POST` or `$_GET` directly.
+Use `get_int()`, `get_str()`, `post_int()` and `post_str()` (from `util.inc`) to get POST and GET data.
+These undo the effects of PHP magic quotes.
 
 === Database access ===