HTML in databse columns

alienzhavelanded · #1 (**permalink**) 12-21-2003, 12:48 PM

Ran across this info recently concerning displaying Access columns with HTML values on a web page:

Do not use HTML in database columns
Do not display or allow HTML in any database columns.

Curious, I set out to research why, and found nothing at all. Anyone know why this would be considered unsafe? TIA

The Martian

redcircle · #2 (**permalink**) 12-21-2003, 05:01 PM

The only thing that I see would be an excess amount of unnecessary database calls that would slow the server down. Use the filesystem. That's what it was intented for. databases are for organizing data.

alienzhavelanded · #3 (**permalink**) 12-22-2003, 12:01 AM

redcircle wrote: The only thing that I see would be an excess amount of unnecessary database calls that would slow the server down.

The question is why displaying the columns with HTML values is considered a secruity issue.

The Martian

redcircle · #4 (**permalink**) 12-22-2003, 05:45 PM

not sure why they consider a security issue.

gohitech · #5 (**permalink**) 01-02-2004, 02:02 PM

I think they meant not to use excessive HTML in your databse "rows".
It would be unsafe becasuse of the way it would be displayed.

It is always a good practice for databased dynamic web development to allow the html to be genrated rather than hardcoded into the database.
But using simple tags (e.g.[*]) won't hurt.(or I belive so)

regards,

Bk