cross-site scripting vulnerability

[Guest]

if i created a new module that uses the same databse as the oscommerce shop, would using:

<?php echo tep_draw_input_field('mynewvalue'); ?>

 

be enough to prevent xss issues?

[kgt]

No, tep_draw_input_field() only creates text boxes. You need to protect against XSS when you process data (after the form has been posted).