title: Safe and effective approach to transfer data between server and client with AJAX/PHP/MySQL?
body: <p>Well I'm new to PHP but thinking about these stuff has really confused me these days.</p>
  
  <p>Here is my question in detail:</p>
  
  <p>First the situtation is that I need to transfer the data between clients and the server. Ajax should be used to present the data at clients' side. At the server side, PHP and MySQL will be used to parse the request, grab the data and then send it back.</p>
  
  <p>Then the problem comes. User data sent from the brower can contain <strong>&amp;, %, ', "</strong> which may damage the formatted POST request or making database attack. Although we can use JS to detect them, the user is still able to send data bypassing the validation, let alone we cannot simply remove them as they may be useful to the user.</p>
  
  <p>So then I checked my weapon library.
  At server side, it turns out that I have too many functions to deal with them:<br>
  Apart from regular expessions I have</p>
  
  <pre><code>htmlspecialchars, htmlspecialchars_decode, addslashes, stripslashes
  urlencode, urldecode, mysql_escape_string, mysql_real_escape_string
  </code></pre>
  
  <p>At client side with javascript, I don't have that many but still have:</p>
  
  <pre><code>escape, unescape
  </code></pre>
  
  <p>OK. Learning that I have so many weapons is good but...how to choose, combine and use them is really a headache for me.</p>
  
  <p>For example suppose I want to have a product name called:  </p>
  
  <p><strong>'%Hooray%'+&amp;ABC</strong></p>
  
  <p>Well maybe no product will be named like this in real life but let's use it as an example.</p>
  
  <p>The &amp; mark will break the POST message.<br>
  The +  may impact ajax parsing.<br>
  Single quotes may allow SQL injection.<br>
  The % mark may cause problems but I'm not sure if it will.</p>
  
  <p>But I still want that name exactly the same after sending it to the database and fetching it back,<br>
  which means, the name in database can be different but its presentation in the brower should be the same.</p>
  
  <p>Well this question may be a little bit too long but hope somebody could share some good experience: how to deal with user input string using those functions?</p>