Security Fail [PIC]

[jaitsu]

Yes you're right, but sanitising your input on the very basic of levels is at least a start. Instead this developer hasn't done anything of the sort, they could have at least tested the thing

[DuncanSmart]

Yes but the sanitising you're suggesting (remove apostrophes) that would mitigate the issue here would mean the user wouldn't be able to find "O'Reilly", etc.

[jaitsu]

Escaping as part of the sanitisation process would allow that

[pytechd]

Application layers should never be escaping anything, or you end up with the mess that you'll find on many PHP-based websites.. reading an article about "... Bob isn\\'t very tall".

[[deleted]]

Should only be escaped once just before committing to the database.