PHP - Need Help Badly! Htmlentities Sql Injection Etc Need Help >.<

Now, I'm trying to figure out some security factors of a website with a login etc.

Would I need to add and strip slashes if I'm using htmlentities on anything that the user enters?

Hi all i was just trying to test out what the effect is of htmlentities() and htmlspecialchars() with an without ENT_QUOTES, but it looks like it's not working as expected. I made a small script to compare the 2 the only thing happends that javascript isn't executed, but i though it would convert special characters into even more special ones

I am running on xampp btw if that helps

$plain_input = "I am going to hax0r your site, hahaha!
    <script type='text/javascript'>
    window.location = 'http://www.google.com/'
    </script>";

     $plain_input2 = htmlentities($plain_input);
     $plain_input2_ent = htmlentities($plain_input,ENT_QUOTES);
        echo '<b>htmlentities: </b>'.$plain_input2.'<br />';
        echo '<b>htmlentities + entquotes: </b>'.$plain_input2_ent.'<br />';
        echo '<hr /><br />';

     $plain_input3 = htmlspecialchars($plain_input);
     $plain_input3_ent = htmlspecialchars($plain_input,ENT_QUOTES);
        echo '<b>htmlspecialchars:</b> '.$plain_input3.'<br />';
        echo '<b>htmlspecialchars + entquotes:</b> '.$plain_input3_ent.'<br />';
        echo '<hr /><br />';


this just outputs:
Code: [Select]
htmlentities: I am going to hax0r your site, hahaha! <script type='text/javascript'>  window.location = 'http://www.google.com/' </script>
htmlentities + entquotes: I am going to hax0r your site, hahaha! <script type='text/javascript'> window.location = 'http://www.google.com/' </script>

htmlspecialchars: I am going to hax0r your site, hahaha! <script type='text/javascript'> window.location = 'http://www.google.com/' </script>
htmlspecialchars + entquotes: I am going to hax0r your site, hahaha! <script type='text/javascript'> window.location = 'http://www.google.com/' </script>

Wondering about htmlentities() as I have a rich text editor implemented on my website, how would I correctly use htmlentities() as I still want the data which was put into the rich text editor to correctly show, sorry for me being a bit vague, it is late and im tired but hope someone can shine some light on this for me

What do most people prefer to use? htmlspecialchars or htmlentities

I have let say Thai language and inserted into database

Code: [Select]
<b>บริษัท เอส.เค.ฟู้ดส์ (ประเทศไทย) จำกัด (มหาชน)
เป็นผู้นำเข้า-ส่งออกปลาทูน่าบรรจุกระป๋อง ต้องการรับสมัครพนักงานเพื่อรองรับการขยายกิจการ</b>
and i retrieve it using this

nl2br(htmlentities($array['message']))

the result will completely messed up as the thai language will be converted either.
if i ignore the htmlentities then i will have that message in bold

how can i achieve the result exactly the same like what has been written (message in thai language with that <b> html tag)??

thanks in advance

So, If I want to store something like:

Code: [Select]
Hello<br />
<b>This is a sentence </b>
I would need to use
htmlentities()

So I could output the HTML after it's stored in the database safely?

Hello Guys ... i am new here and i am also new in php

i selfstudy html css and js and bootstrap for front-end

and for back-back php & mysql & PDO  & OOP and  i will soon start mvc then laravel

and i am trying to secure my input field  and i do not want any attacks or sql injects

and i see people user filter_var and htmlentities and htmlspecialchars  and each one has diffrent opinion

can some one help me and tell me what is the best for securing input which all values will store in database

thanks <3

I have a function with a query and then a while loop and then an if file_exists with an image path.  I am getting the image path displayed as text.  Would this be because I am running the query through json encoding?

Does anyone have an example of when htmlentities() would be used over htmlspecialchars()?

I have the following session timeout code which should redirect users of a website to a page (session_expired.php) which prints out a message telling the user that his session has expired.  I include this code at the top of every page in the website, that requires user authentication. Code: [Select]

<?php


//address error handling

ini_set ('display_errors', 1);
error_reporting (E_ALL & ~E_NOTICE);


if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) {
    // last request was more than 30 minates ago
    session_destroy();   // destroy session data in storage
    session_unset();     // unset $_SESSION variable for the runtime
    header("location: session_expired.php");
}
$_SESSION['LAST_ACTIVITY'] = time(); // update last activity time stamp


?>

The session_expired.php page which I will include below, has a login link, which takes the user to a login page (access_denied.php) Code: [Select]


<?php

//address error handling

ini_set ('display_errors', 1);
error_reporting (E_ALL & ~E_NOTICE);




//Set the page title before the header file
$title = 'Session Expired';

require ('header.php'); //need the header

?>









      <div id="content" class="">



<div id="left_content" class="">





</div> <!--closes left content-->





<div id="right_content" class="">

<div id= "right_content_inner_border">


<h5 style ="position:relative;left:660px;top:1px;"> <a style="text-decoration:none" href="access_denied.php">[Login]</a> </h5>


<h3 style ="position:relative;left:110px;top:100px; font-color:blue;"> You Session Expired Due to Inactivity! </h3>


</div> <!--closes right content inner border-->

</div> <!--closes right content-->




</div> <!--closes content-->
















<?php

require ('footer.php'); //need the footer




?>
 
 


Now here lies the problem.  When i set the session timeout to say 60 seconds to test the code, everything seems to work perfectly.  The authenticated page gets redirected to session_expired.php after 1 minute and when the user clicks on the login link, he is taken back to the login page(access_denied.php).    However, when I replace the time with 1800 seconds, the page notice that when I leave the page idle for JUST about 5 minutes, it gets redirected NOT even to the expected session_expired.php page but strangely, directly to the login page(access_denied.php).  What could be going wrong here?  Any hint is appreciated. 

I have a problem which I've been trying to fix for a while now with htmlentities.

I've written my own small cms which is available for the public, and recently I recieved a report that it's vulnerable to an XSS attack:

http://host/editText.php?fieldname=slogan&content=slogan<img src=x onerror=alert("XSS")>
This vulnerability only works if the user is logged in. I want to secure it anyway to give the security companies contacting me about this a break.

I've been rolling around the internet trying to find a simple answer how to prevent this XSS attack with HTMLENTITIES.

I've even tried writing my own solutions with the htmlentities and it doesn't seem to solve the problem/stop the attack.

I'm thinking something like
htmlEntities($content); //but again, this won't do the job.

Here's the editText.php
Code: [Select]
<?php

   session_start();

function getSlug( $page ) {
   $page = strip_tags( $page );
   preg_match_all( "/([a-z0-9A-Z-_]+)/", $page, $matches );
   $matches = array_map( "ucfirst", $matches[0] );
   $slug = implode( "-", $matches );
   return $slug;
}

   $fieldname = $_REQUEST['fieldname'];
   
   $encrypt_pass = @file_get_contents("files/password");
   if ($_COOKIE['wondercms']!=$encrypt_pass)
   {
   echo "You must login before using this function!";
   exit;
   }
   
   $content = rtrim(stripslashes($_REQUEST['content']));
   // if to only allow specified tags
   if($fieldname=="title")    $content = strip_tags($content);
   else $content = strip_tags($content,"<audio><source><embed><iframe><p><h1><h2><h3><h4><h5><h6><a><img><u><i><em><strong><b><strike><center><pre>");

   $content = trim($content);
   $content = nl2br($content);

   if(!$content) $content = "Please be sure to enter some content before saving. Just type anything in here.";

   $content = preg_replace ("/%u(....)/e", "conv('\\1')", $content);

   if($fieldname>0 && $fieldname<4) $fname = "attachment$fieldname";
   else $fname = $fieldname;
   $file = @fopen("files/$fname.txt", "w");
   if(!$file)
   {
echo "<h2 style='color:red'>*** ERROR *** unable to open content_$fieldname</h2><h3>But don't panic!</h3>".
"Please set the correct read/write permissions to the files folder.<br/>
Find the /files/ folder and CHMOD it to 751.<br /><br />
If this still gives you problems, open up the /files/ folder, select all files and CHMOD them to 640.<br /><br />
If this doesn't work, contact me <a href='http://krneky.com/en/contact'>right here</a>.";
   exit;
   }
   fwrite($file, $content);
   fclose($file);

   echo $content;
   
   // convert udf-8 hexadecimal to decimal
   function conv($hex)
   {
   $dec = hexdec($hex);
   return "&#38;#$dec;";
   }
?>


There are only 3 files altogether, if someone needs index I'll post that too.

I have never looked into sanitizing before, Is using htmlentities() good enough to protect against sql injection ?

Thanks.

Hey Guys!
I would really like some feedback on the following:

I have a site in Portuguese. Php retrieves a lot of POST's with Special Characters and Portuguese Accents (which are expected).
With my sanatize function I am having some real problems with the 'htmlentities' for XSS Injection Prevention.
htmlentities is changing the accents to strange characters and messes up my database.

sanitize( &$_GET );
sanitize( &$_POST );
sanitize( &$_COOKIE );

function sanitize( &$some) 
{
$some = array_map('htmlentities', $some); //XSS Prevention

foreach( $some as $key => $value ) 
{
$value = str_replace( '--', '', $value );
$value = str_replace( '/*', '', $value );
$value = str_replace( '"', '', $value );
$value = str_replace( "'", '', $value );
$value = ereg_replace( '[\( ]+0x', '', $value );
if ($value != $some[$key]) 
{
$some[$key] = $value;
}
}
}

The only solution I can think of is to take out the 'htmlentities' function, but I would really like to have this as a prevention against XSS, is there any way around this to have both things working?

Any ideas, suggestions?

Thanks in advance!