title: Security strategies in PHP website: SQL Injection, XSS attack and 2nd order SQL Injection
body: <p>I am a tyro in web security and have been researching on it for two days. According to OWSAP, SQL Injection and XSS attacks are the most common over the internet and at the minimal must be handled by every programmer.</p>
  
  <p>So whatever I understood to protect them is the following (you are requested to correct it or add if I am wrong):</p>
  
  <p><code>Use PDO and prepared statements to prevent SQL Injection</code></p>
  
  <p>PDO and prepared statements are sufficient to prevent (first-order) SQL Injection and we do not need to do any escaping on input data as the driver handles that.</p>
  
  <p><strong>BUT</strong> this may lead you prone to second order SQL injection (<a href="https://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection?rq=1">see this for more</a>) where a data like <code>' OR '1'='</code> may get stored into the database after passing through the PDO and prepared statements as they store raw data and to prevent this makes me feel to rather escape the string first and hence</p>
  
  <p><code>use $pdo-&gt;quote($string) before passing it to prepared statement for storage</code></p>
  
  <p>But since I also want protection against XSS attack I should use <code>htmlentities()</code> as well (or <code>htmlspecialchars()</code> for minimal case) .I should do this at the output but I may prefer to use at the input side if my output is targeted for HTML only</p>
  
  <p>To summarize,my steps would be</p>
  
  <pre><code>$string ='raw input from user';
  $escaped_string=$pdo-&gt;quote(htmlentities($string));
  $pdo-&gt;execute('query to store $escaped_string  into the database');
  </code></pre>
  
  <p>while ouputting</p>
  
  <p>simply echo the stored field from the database.</p>
  
  <p>I want to know whether my approach is secure or not?</p>