PHP - [php] Can't Cast (arabic) Numeric Input As (int)

Hey Guys...I am trying to secure my php file and have been reading a lot regarding sql injection.

I still dont understand clearly how to prevent sql injection through numeric data input, since from what I understood mysql_real_escape_string() does nothing about it only prevents attacks on string input.

Here's an example:


if ($action == "checkId")
{
//retreive data from flash
$user_id=mysql_real_escape_string($_POST['Id']);


$result = mysql_query("SELECT user_id from users WHERE user_id = '$user_id'");
if (mysql_num_rows($result) > 0) 
{
echo "status1=exists";
} 
else 
{
echo "status1=id doesnt exist";
}
}


I would like to create a function like this:

foreach($_POST as $post)
{
$postvars[$key] = htmlentities($post); //XSS prevention
$postvars[$key] = mysql_real_escape_string($post); //Sql String Prevention
}

But then again...How do I check on the numeric POST's ? how do I validate them through this function?

Any suggestions and/or ideas?

Thanks a lot in advance!
Cheers.

Hi all,

I've just started upgrading from procedural style mysql statements to object orientated style mysqli prepared statements. I was just hoping someone could look over my registration page statement code and tell me if there are any bits that are unecessary or a security issue (All of the code does already work - just want it checking)

The reason I would like them checked over is because I've never touched OOP or mysqli in my life as I haven't been doing php all that long. I've had my own mysql statements running great for a couple of years but I want to keep with the times! If they are ok, then I'll go on to convert the remainder of the site

First of all I include the mysqli database connection script before each mysqli statements (as php auto drops the connection once the script has finished - a little annoying as it increases the code. But I can see the resources advantages.  ):

../db/dbauth.php (outsite www root):
Code: [Select]
$mysqli = new mysqli($hostname_lh, $username_lh, $password_lh, $database_lh);

if (mysqli_connect_errno()) {
$mess = "There was a mysqli connection error! Mysqli Error: " . mysqli_connect_error();
$contact_email = "webmaster@website.com";
$message_sub = "Mysqli Connection Error";
$hdrs = "From: " . $contact_email . "\r\n";
$hdrs .= "Reply-To: ". $contact_email . "\r\n";
$hdrs .= "MIME-Version: 1.0\r\n";
$hdrs .= "Content-Type: text/html; charset=UTF-8\r\n";
mail($contact_email, $message_sub, $mess, $hdrs);
exit();
}

The above will send an email if there are any connection problems. This file has to be called before each mysqli statement... is there an easier way of doing this? I don't want to have it in my file as it contains the password/database details. Do I have to include the file each time I use mysqli in a file as I have been doing? Some files contain upto 4-5 mysqli statements, so i'm effectively including the dbauth.php file 4-5 times.

Anyways to the statements:

First prepared statement is for populating a countries drop down box:
Code: [Select]
// connect to db for mysqli
require_once('../db/dbauth.php');

// populates countries drop down
$countrystmt = $mysqli->stmt_init();
if ($countrystmt = $mysqli->prepare("SELECT country FROM countries")){
$countrystmt->execute();
$countrystmt->bind_result($option);
while ($countrystmt->fetch()) {
// records stored in $option
echo "<option value='" . $option . "'";
if ($user_country == $option) {
echo " selected";
}
echo ">" . $option . "</option>";
}
$countrystmt->close();
}
$mysqli->close();

This one checks the db to see if the user already exists:
Code: [Select]
// connect to db for mysqli
require_once('../db/dbauth.php');

// checks if the username is in use
$result = $mysqli->stmt_init();
if ($result->prepare("SELECT their_username FROM users WHERE their_username=?")){
$result->bind_param("s", $their_username);
$result->execute();
$result->store_result();
$row_count = $result->num_rows;
$result->close();
}
// if query errors sends an email
$mysqli->close();

// if the name exists it gives an error
if ($row_count != NULL) { //..... .... ....


next one inserts a new user into the db (after some santitising of inputs):
Code: [Select]
// connect to db for mysqli
require_once('../db/dbauth.php');

// inserts a new user
$null = NULL;
$insert_stmt = $mysqli->stmt_init();
if ($insert_stmt->prepare("INSERT INTO members VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
$insert_stmt->bind_param('issssssssssssiiiiisiis', $null, $user_name, $user_companyname, $user_email, $user_1stline, $user_address2, $user_town, $user_county, $user_postcode, $user_country, $user_tel, $their_username, $null, $zero, $zero, $zero, $zero, $zero, $user_serial, $zero, $zero, $zero);
$insert_stmt->execute();
$insert_stmt->close();
}

// if query errors sends an email
if ($mysqli->error) {
try {   
throw new Exception("MySQL error $mysqli->error <br> Query:<br> $query", $mysqli->errno);   
} catch(Exception $e ) {
$mess = "Error No: ".$e->getCode(). " - ". $e->getMessage() . "<br >";
$mess .= nl2br($e->getTraceAsString());
$contact_email = "webmaster@website.com";
$message_sub = "Mysqli Registration Query Error [UAU01]";
$hdrs = "From: " . $contact_email . "\r\n";
$hdrs .= "Reply-To: ". $contact_email . "\r\n";
$hdrs .= "MIME-Version: 1.0\r\n";
$hdrs .= "Content-Type: text/html; charset=UTF-8\r\n";
mail($contact_email, $message_sub, $mess, $hdrs);
}
header("refresh: 10; registration.php");
die('ERROR: Unable to add you as a new user. Please report this error to us using our contact us form.<br><br>We will redirect you back to the registration form in 10 seconds.<br><br><div style="margin: auto; text-align: center;"><img src="http://static.website.com/images/loading.gif" alt="loading"></div>');
exit();
}
$mysqli->close();

If the script above errors then it will send an error email to the webmaster (me) and also give a friendly error to the user before redirecting back to a registration page.

I've got a similar error and refresh method for the other statements further up, but didn't think I should overload everyone with loads of similar code! 

Anyways,  muchos help always appreciated!!!

Just wondering if anyone knew of one? I have been looking for ages but can't find what I need.


In java:


Code: [Select]

public class Test {
    public static void main(String[] args) {
        System.out.println((byte)0xff);
    }
}
Outputs:
Code: [Select]
-1

I've tried things like

<?php
$var = pack('H', 0xff);
echo $var;
?>

But that doesn't output anything

Hi,

I am generating certificates in php i can display the name in arabic but it will not print on the certicate. It can show the English names though! is there a special code to be able to show that?

code:

<!doctype html>
<html lang="en">
  <head>
    <!-- Required meta tags -->
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

    <!-- Bootstrap CSS -->
    <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css" integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin="anonymous">

    <title>Certificate Generator</title>
  </head>
  <body>
    <center>
      <br><br><br>
      <h3>Certificate Generator</h3>
      <br><br><br><br>
      <form method="post" action="">
      <div class="form-group col-sm-6">
        <input type="text" name="name" class="form-control" id="name" placeholder="Enter Name Here...">
      </div>
      <button type="submit" name="generate" class="btn btn-primary">Generate</button>
    </form>
    <br>
    <?php 
      if (isset($_POST['generate'])) {
        $name = strtoupper($_POST['name']);
        $name_len = strlen($_POST['name']);

        if ($name == "" ) {
          echo 
          "
          <div class='alert alert-danger col-sm-6' role='alert'>
              Ensure you fill all the fields!
          </div>
          ";
        }else{
          echo 
          "
          <div class='alert alert-success col-sm-6' role='alert'>
              Congratulations! $name on your excellent success.
          </div>
          ";

          //designed certificate picture
          $image = "certi.png";

          $createimage = imagecreatefrompng($image);

          //this is going to be created once the generate button is clicked
          $output = "certificate.png";

          //then we make use of the imagecolorallocate inbuilt php function which i used to set color to the text we are displaying on the image in RGB format
          $white = imagecolorallocate($createimage, 205, 245, 255);
          $black = imagecolorallocate($createimage, 0, 0, 0);

          //Then we make use of the angle since we will also make use of it when calling the imagettftext function below
          $rotation = 0;

          //we then set the x and y axis to fix the position of our text name
          $origin_x = 200;
          $origin_y=240;

          //we then set the x and y axis to fix the position of our text occupation
          $origin1_x = 120;
          $origin1_y=90;

          //we then set the differnet size range based on the lenght of the text which we have declared when we called values from the form
          if($name_len<=7){
            $font_size = 25;
            $origin_x = 190;
          }
          elseif($name_len<=12){
            $font_size = 30;
          }
          elseif($name_len<=15){
            $font_size = 26;
          }
          elseif($name_len<=20){
             $font_size = 18;
          }
          elseif($name_len<=22){
            $font_size = 15;
          }
          elseif($name_len<=33){
            $font_size=11;
          }
          else {
            $font_size =10;
          }

          $certificate_text = $name;

          //font directory for name
          $drFont = dirname(__FILE__)."/developer.ttf";

          //function to display name on certificate picture
          $text1 = imagettftext($createimage, $font_size, $rotation, $origin_x, $origin_y, $black,$drFont, $certificate_text);

          imagepng($createimage,$output,3);

 ?>
        <!-- this displays the image below -->
        <img src="<?php echo $output; ?>">
        <br> 
        <br>

        <!-- this provides a download button -->
        <a href="<?php echo $output; ?>" class="btn btn-success">Download My Internship Certificate</a>
        <br><br>
<?php 
        }
      }

     ?>

    </center>

      <footer>  
          <center><p>Built with &#10084; by <a href="https://olawanlejoel.github.io/portfolio/">Olawanle Joel</a></p></center>
      </footer>

    <!-- Optional JavaScript -->
    <!-- jQuery first, then Popper.js, then Bootstrap JS -->
    <script src="https://code.jquery.com/jquery-3.4.1.slim.min.js" integrity="sha384-J6qa4849blE2+poT4WnyKhv5vZF5SrPo0iEjwBvKU7imGFAV0wwj1yYfoRSJoZ+n" crossorigin="anonymous"></script>
    <script src="https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js" integrity="sha384-Q6E9RHvbIyZFJoft+2mJbHaEWldlvI9IOYy5n3zV9zzTtmI3UksdQRVvoxMfooAo" crossorigin="anonymous"></script>
    <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js" integrity="sha384-wfSDF2E50Y2D1uUdj0O3uMBJnjuUD4Ih7YwaYd1iqfktj0Uod8GCExl3Og8ifwB6" crossorigin="anonymous"></script>
  </body>
</html>

 

Edited May 22, 2020 by ramiwahdan
typo error

I have created a Post php form, It send two emails, One email to the user after they submit the form and other to me. Now the users will fill up the form in arabic and a confirmation email will be sent to them in arabic also...I tested my form, I get the confirmation email in arabic, its fine, but the data tht the user inputs in arabic on the form comes to my email with strange characters.....i want to receive the data entered by user in arabic. Below is the HTML and Php


Here is my HTML
Code: [Select]
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="ar" xml:lang="ar" xmlns="http://www.w3.org/1999/xhtml">
<head>
<link href="../../css/cssfinal.css" type="text/css" rel="stylesheet">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="ar">
<title>Untitled Document</title>
<style type="text/css">
<!--

body {
background-color: #FFFFFF;
}

.style8 {color: #FF0000}
-->
</style>

<script src="../../SpryAssets/SpryValidationTextField.js" type="text/javascript"></script>
<script src="../../SpryAssets/SpryValidationSelect.js" type="text/javascript"></script>
<link href="../../SpryAssets/SpryValidationTextField.css" rel="stylesheet" type="text/css" />
<link href="../../SpryAssets/SpryValidationSelect.css" rel="stylesheet" type="text/css" />
</head>
<body>
<table align="center" width="547" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
  </tr>
</table>

<form method="post" name="enquiry" action="sendmailsqlar.php">
<table width="547"  align="center" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td height="101" background="../../images/formhead.png"><div align="center" class="status" style="margin-bottom:20px; margin-top:20px">نموذج الاستفسار عن الدورة الأكاديمية</div></td>
  </tr>
</table>


<table width="547" border="0" align="center" cellspacing="0" cellpadding="0">
  <tr>
    <td width="275"><div align="right"><input name="Name" type="text" id="visitor" value="" size="36" class="field"   /></div></td>
    <td width="272" align="right"><div style="margin-left:25px; margin-bottom:10px; margin-top:10px; font-size:18px;">
      <div style="margin-right:25px;">الاسم</div>
      <span id="sprytextfield1"><span class="textfieldRequiredMsg">مطلوب</span></span></div></td>
  </tr>
  <tr>
    <td><div align="right"><input name="Email" type="text" id="visitormail" size="36" class="field" /></div></td>
    <td align="right"><div style="margin-left:25px; margin-bottom:10px; margin-top:10px; font-size:18px;">
      <div style="margin-right:25px;">البريد الإلكتروني</div>
      <span id="sprytextfield2"><span class="textfieldRequiredMsg">مطلوب</span><span class="textfieldInvalidFormatMsg">غير صحيح </span></span></div></td>
  </tr>
  <tr>
    <td><div align="right"><input name="Nationality" type="text" id="nationality" size="36" class="field" /></div></td>
    <td align="right"><div style="margin-left:25px; margin-bottom:10px; margin-top:10px; font-size:18px;">
      <div style="margin-right:25px;">الجنسية</div>
      <span id="sprytextfield2"><span class="textfieldRequiredMsg">مطلوب</span></span></div></td>
  </tr>
 
  <tr>
    <td align=""><div align="right">
      <select name="Level" id="stulevel" size="1" class="select">
        <option value=""><span class="drop.Text">(إختر)</span></option>
        <option value=" Foundation/Diploma ">دبلوم</option>
        <option value=" Bachelor Degree ">البكالوريوس</option>
        <option value=" Master Degree ">ماجستير</option>
        <option value=" PhD./Others ">دكتوراه</option>
      </select>
    </span></div></td>
    <td align="right"><div style="margin-left:25px; margin-bottom:10px; margin-top:10px; font-size:18px;">
      <div style="margin-right:25px;">المرحلة الدراسية المطلوبه</div>
      <span id="spryselect1"><span class="selectRequiredMsg">مطلوب</span></span></div></td>
  </tr>
  <tr>
    <td><div align="right"><input name="Field" type="text" id="stfield" size="36" class="field"  /></div> </td>
    <td align="right"><div style="margin-left:25px; margin-bottom:10px; margin-top:10px; font-size:18px;">
      <div style="margin-right:25px;">مجال الدراسة \ التخصص</div>
      <span id="sprytextfield3"><span class="textfieldRequiredMsg">مطلوب</span></span></div></td>
  </tr>
  <tr>
    <td colspan="2"><table width="547" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td width="275"><label>
          <div align="right"><textarea name="Message" style="background-color:#ccc2b2" class="field" id="message" cols="27" rows="6"></textarea></div>
          </label></td>
        <td width="272" align="right"><div style="margin-left:25px; margin-bottom:10px; margin-top:10px; font-size:18px;">
          <div style="margin-right:25px;">ملاحظات</div>
          </div></td>
        </tr>
      </table></td>
  </tr>
  <tr>
    <td colspan="2" height="101" background="../../images/formfoot.png"><div align="center" style="margin-top:15px">
      <input type="submit" class="btn1"  value="إرسال" />
    </div></td>
    </tr>

</table>
</form>
<script type="text/javascript">
<!--
var sprytextfield1 = new Spry.Widget.ValidationTextField("sprytextfield1");
var sprytextfield2 = new Spry.Widget.ValidationTextField("sprytextfield2", "email");
var sprytextfield3 = new Spry.Widget.ValidationTextField("sprytextfield3");
var spryselect1 = new Spry.Widget.ValidationSelect("spryselect1");
var sprytextfield4 = new Spry.Widget.ValidationTextField("sprytextfield4");
//-->
</script>
</body>
</html>

Here is the PHP

Code: [Select]
<html dir="rtl">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta http-equiv="Content-Language" content="ar">
</head>

<?php 
$to = "xx@xxx.com";
$visitor = $_REQUEST['Name'] ;
$visitormail = $_REQUEST['Email'] ;
$nationality = $_REQUEST['Nationality'] ;
$stulevel = $_REQUEST['Level'] ;
$stfield = $_REQUEST['Field'] ;
$message = $_REQUEST['Message'] ;
$header = "From: $visitormail\n"
  . "Reply-To: $visitormail\n";
$subject = "Arab Enquiry";
$message = "From: $visitor \n\n Email: $visitormail \n\n Nationality: $nationality \n\n Level: $stulevel \n\n Field: $stfield \n\n Message: $message";
$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
mail($to, $subject, $message, $header);

//Sending auto respond Email to visitor
$reply_header = "From: ttt@ttt.com\n"
  . "Reply-To: vvv@vvv.com\n";
$reply_subject = " - &#1578;&#1605; &#1575;&#1587;&#1578;&#1604;&#1575;&#1605; &#1591;&#1604;&#1576;&#1603;&#1605;";
$reply_to = "$visitormail";
$reply_message = "$visitor \n\n &#1588;&#1603;&#1585;&#1575; &#1604;&#1586;&#1610;&#1575;&#1585;&#1578;&#1603;&#1605; &#1605;&#1608;&#1602;&#1593;&#1606;&#1575; . \n &#1606;&#1608;&#1583; &#1575;&#1576;&#1604;&#1575;&#1594;&#1603;&#1605; &#1576;&#1571;&#1606;&#1607; &#1578;&#1605; &#1575;&#1587;&#1578;&#1604;&#1575;&#1605; &#1591;&#1604;&#1576;&#1603;&#1605; &#1608;&#1587;&#1608;&#1601; &#1610;&#1578;&#1605; &#1575;&#1604;&#1585;&#1583; &#1593;&#1604;&#1610;&#1603;&#1605; &#1602;&#1585;&#1610;&#1576;&#1575;.\n &#1607;&#1584;&#1607; &#1575;&#1604;&#1585;&#1587;&#1575;&#1604;&#1577; &#1605;&#1585;&#1587;&#1604;&#1577; &#1605;&#1606; &#1606;&#1592;&#1575;&#1605; &#1575;&#1604;&#1605;&#1608;&#1602;&#1593;.\n &#1588;&#1603;&#1585;&#1575;\n .";
$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
mail($reply_to, $reply_subject, $reply_message, $reply_header);

header("Location: thankyouar.html");

?>
please help !!!! i would appreciate