PHP - Problem With Htmlentities

I don't really understand what htmlentities() does and when to use it?!

The manual says this...

<?php
$str = "A 'quote' is <b>bold</b>";

// Outputs: A 'quote' is &lt;b&gt;bold&lt;/b&gt;
echo htmlentities($str);

// Outputs: A &#38;#039;quote&#38;#039; is &lt;b&gt;bold&lt;/b&gt;
echo htmlentities($str, ENT_QUOTES);
?>


1.) Isn't there a way to print this...
Code: [Select]
$str = "A 'quote' is <b>bold</b>";
...as this...
Quote

A 'quote' is <b>bold</b>


That is, WYSIWYG.

2.) When and why would you want this displayed...
Quote

A 'quote' is &lt;b&gt;bold&lt;/b&gt;


I am trying to make my code more secure, and I was told to use something like this on all code that comes from the User and needs to be output, but I'm a little lost here...

echo ' <div class="userInfo">
<a href="#" class="username">
<strong>' . nl2br(htmlentities($username)) . '</strong>
</a>';

Debbie

Wondering about htmlentities() as I have a rich text editor implemented on my website, how would I correctly use htmlentities() as I still want the data which was put into the rich text editor to correctly show, sorry for me being a bit vague, it is late and im tired but hope someone can shine some light on this for me

Now, I'm trying to figure out some security factors of a website with a login etc.

Would I need to add and strip slashes if I'm using htmlentities on anything that the user enters?

Does anyone have an example of when htmlentities() would be used over htmlspecialchars()?

So, If I want to store something like:

Code: [Select]
Hello<br />
<b>This is a sentence </b>
I would need to use
htmlentities()

So I could output the HTML after it's stored in the database safely?

Hello Guys ... i am new here and i am also new in php

i selfstudy html css and js and bootstrap for front-end

and for back-back php & mysql & PDO  & OOP and  i will soon start mvc then laravel

and i am trying to secure my input field  and i do not want any attacks or sql injects

and i see people user filter_var and htmlentities and htmlspecialchars  and each one has diffrent opinion

can some one help me and tell me what is the best for securing input which all values will store in database

thanks <3

I have a function with a query and then a while loop and then an if file_exists with an image path.  I am getting the image path displayed as text.  Would this be because I am running the query through json encoding?

ok here is my comment protection >< very basic and simple but i just got htmlentitied lol =[ how do i protect against that?
Code: [Select]
if (isset($_POST['submit'])) {

$comment= trim(stripslashes(mysql_real_escape_string($_POST['comment'])));
this is my registration protection, sql can still get though >< it doesnt work ?
Code: [Select]
$_POST['pass'] = md5($_POST['pass']);
  if (!get_magic_quotes_gpc()) {
  $_POST['pass'] = trim(stripslashes(mysql_real_escape_string($_POST['pass'])));
  $_POST['username'] = trim(stripslashes(mysql_real_escape_string($_POST['username'])));
  }

I have a problem which I've been trying to fix for a while now with htmlentities.

I've written my own small cms which is available for the public, and recently I recieved a report that it's vulnerable to an XSS attack:

http://host/editText.php?fieldname=slogan&content=slogan<img src=x onerror=alert("XSS")>
This vulnerability only works if the user is logged in. I want to secure it anyway to give the security companies contacting me about this a break.

I've been rolling around the internet trying to find a simple answer how to prevent this XSS attack with HTMLENTITIES.

I've even tried writing my own solutions with the htmlentities and it doesn't seem to solve the problem/stop the attack.

I'm thinking something like
htmlEntities($content); //but again, this won't do the job.

Here's the editText.php
Code: [Select]
<?php

   session_start();

function getSlug( $page ) {
   $page = strip_tags( $page );
   preg_match_all( "/([a-z0-9A-Z-_]+)/", $page, $matches );
   $matches = array_map( "ucfirst", $matches[0] );
   $slug = implode( "-", $matches );
   return $slug;
}

   $fieldname = $_REQUEST['fieldname'];
   
   $encrypt_pass = @file_get_contents("files/password");
   if ($_COOKIE['wondercms']!=$encrypt_pass)
   {
   echo "You must login before using this function!";
   exit;
   }
   
   $content = rtrim(stripslashes($_REQUEST['content']));
   // if to only allow specified tags
   if($fieldname=="title")    $content = strip_tags($content);
   else $content = strip_tags($content,"<audio><source><embed><iframe><p><h1><h2><h3><h4><h5><h6><a><img><u><i><em><strong><b><strike><center><pre>");

   $content = trim($content);
   $content = nl2br($content);

   if(!$content) $content = "Please be sure to enter some content before saving. Just type anything in here.";

   $content = preg_replace ("/%u(....)/e", "conv('\\1')", $content);

   if($fieldname>0 && $fieldname<4) $fname = "attachment$fieldname";
   else $fname = $fieldname;
   $file = @fopen("files/$fname.txt", "w");
   if(!$file)
   {
echo "<h2 style='color:red'>*** ERROR *** unable to open content_$fieldname</h2><h3>But don't panic!</h3>".
"Please set the correct read/write permissions to the files folder.<br/>
Find the /files/ folder and CHMOD it to 751.<br /><br />
If this still gives you problems, open up the /files/ folder, select all files and CHMOD them to 640.<br /><br />
If this doesn't work, contact me <a href='http://krneky.com/en/contact'>right here</a>.";
   exit;
   }
   fwrite($file, $content);
   fclose($file);

   echo $content;
   
   // convert udf-8 hexadecimal to decimal
   function conv($hex)
   {
   $dec = hexdec($hex);
   return "&#38;#$dec;";
   }
?>


There are only 3 files altogether, if someone needs index I'll post that too.

I have never looked into sanitizing before, Is using htmlentities() good enough to protect against sql injection ?

Thanks.

Guys thanks for helping me solve the problem i had but now i have another problem and i am lost. i have included the code below for you to have overview.

On the home page the url shows how it should be: http://localhost/board/italian.php?country=Italian
BUT 
When you mouse over the NEXT link to go to next page you get this : http://localhost/board/?page=1&country=Italian  and then an error 404 when you click on the link
page = 1  no matter if you are mousing over link for page 5 or 2

This is the code:

<table style="width:100%; margin-left:auto; margin-right:auto">
        <?php    
            
            $items_per_page = 5;//how many records/rows to display per page
                        
            $page_url      = "http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
                                    
            $cleaned_current_page_country = htmlspecialchars($_GET["country"]);
                        
            $page_number = (isset($_GET['page']))? filter_var($_GET['page']) : 1;
            //$page_number = filter_var($_GET['page']);
            //$page_number = $_GET['page'];
                
            $selected_restaurant_type = $_GET['country'];
                                                            
            // find number of rows in the db
                $query = "SELECT * FROM menu_update WHERE special_of_theday = 1 AND restaurant_type = '".$selected_restaurant_type."' ";
                $query_result = mysqli_query($connection, $query); 
                $row_count = mysqli_fetch_array($query_result);
                $total_rows = mysqli_num_rows($query_result);
                                                
            $expected_number_of_pages = ceil($total_rows/$items_per_page); //expected number of pages 
                                                
            $page_position = (($page_number - 1) * $items_per_page); //get starting position to fetch record
                        
            //fetch a group of records using sql LIMIT clause
                $query = "SELECT * FROM menu_update WHERE special_of_theDay = 1 AND restaurant_type = '".$selected_restaurant_type."' LIMIT " .$page_position. ',' .$items_per_page;
                $query_result = mysqli_query($connection, $query);
        ?>
                        
            <table width="100%" border=0>
                <tr bgcolor = "#cccccc">
                    <td>Meal</td>
                    <td>Meal name</td>
                    <td>Meal Price</td>
                    <td>Order Now</td>
                    <td>Full Menu</td>
                    <td>Our Gallery</td>
                    <td>Find Us</td>
                    <td>Our Chef</td>
                    <td>Our Manager</td>
                </tr>
        <?php
                while($row_count = mysqli_fetch_array($query_result)){
                    echo "<tr>";
                        echo"
                            <td style ='width:200px; text-align:center; height:120px; background:#eaedf2'><a href='meal_fullPic.php'><img src= ".$row_count['img']." /></a></td>
                            <td style ='width:119px; text-align:center; height:120px; background:#eaedf2'> ".$row_count['meal_name']."</td>
                            <td style ='width:100px; text-align:center; height:120px; background:#eaedf2'>".$row_count['price']."</td>
                            <td style ='width:100px; text-align:center; height:120px; background:#eaedf2'><a href='order_processor.php'><img src= ".$row_count['order_now']." /></a></td>
                            <td style ='width:100px; text-align:center; height:120px; background:#eaedf2'><a href='full_menu.php'><img src= ".$row_count['full_menu_img']." /></a></td>
                                    
                            <td style ='width:170px; text-align:center; height:120px; background:#eaedf2'><a href='restaurant_gallery.php'><img src= ".$row_count['restaurant_pic']." /></a></td>
                            <td style ='width:100px; text-align:center; height:120px; background:#eaedf2'><a href='restaurant_location.php'><img src= ".$row_count['location_pic']." /></a></td>
                            <td style ='width:119px; height:120px; background:#eaedf2'> ".$row_count['chef_name']."</td>
                            <td style ='width:119px; height:120px; background:#eaedf2'> ".$row_count['admin']."</td>
                        "; 
                    echo "</tr>";
                }
                mysqli_close($connection);
        ?>    
            </table>
        <div class="board_pagination">
        <?php
            //display the links to the pages
            for($current_page = 1; $current_page <= $expected_number_of_pages; $current_page++){
                 if ($page_number != $expected_number_of_pages){
                    $data = array(
                        'page' => $page_number,
                        'country' => $cleaned_current_page_country,
                    );
                    $the_query = http_build_query($data);
                    $page_url .= '?' . $the_query;
                    echo '<li><a href=" '.$the_query.' ">'.$current_page.'</a></li> ';
                }
            }
        ?>
        </div>
    </table>
 

The problem is whit the var $threadid .
It dosent work here(it dosen't display the data from database):  $dbh = "SELECT *FROM comments WHERE threadid = '".$threadid."' ";
But if I assign a value before the that code the html page show correctly.


Code: [Select]
include("config.php");

$name = $_POST['name'];
$comment = $_POST['comment'];
$threadid = $_POST['threadid'];

if($name & $comment)
{
$dbh="INSERT INTO comments (name,comment,threadid) VALUES ('$name','$comment','$threadid') ";
mysql_query($dbh);


}



 
   
    $dbh = "SELECT *FROM comments WHERE threadid = '".$threadid."' ";
    $req = mysql_query($dbh);
    while($row=mysql_fetch_array($req))
    {
         echo "<li>";
        echo "<br>"."<b>".$row['name']."</b></br>"."<br>".$row['comment']."</br>";
echo "</li>";
    }

Code: [Select]
$('.submit').click(function(){
  location.reload();
var name = $("#name").val();
            var comment = $("#comment").val();


var threadid  = $("#v").val();

var dat = 'name='+name+'&comment='+comment+'&threadid='+threadid;

            $.ajax({
type:"post",
    url:"comment.php",
data:dat,
success:function(){
console.log("dat");
}
      });
             
return false;

});

so i want to call my php file with a query string to select a record out of a XML file... im close but cant get the variable i pass to be the record selected..

example... index.php?auction=1

i highlighted in red, where it doesnt pick up the proper row


Code: [Select]
<?php
ini_set('display_errors', 1); 
error_reporting(E_ALL);

$auction = $_GET{auction}; 


// parse the xml
$xmlFileData = file_get_contents("items.xml");
$xmlData = new SimpleXMLElement($xmlFileData);

[color=red]$location = $xmlData->item[$auction];[/color]

//Retrieving the content from the selected item
$title = $location->title;
$value = $location->value;
$itemnumber = $location->itemnumber;
$description = $location->description;
$donatedby = $location->donatedby;
$image1 = $location->image1;
$image2 = $location->image2;
$image3 = $location->image3;
$image4 = $location->image4;
$image5 = $location->image5;
$image6 = $location->image6;
$image7 = $location->image7;
$image8 = $location->image8;

?>


<style>
.itemimages img {width: 10px; height: 10px;}
img.large {width: 100px; height: 100px;}
</style>
<script language="JavaScript" src="http://code.jquery.com/jquery-1.5.min.js" type="text/javascript"></script>
<script>
$().ready(function() {

$(".itemimages img").click(
$("#largepic").attr("src","this");
 });


});
</script>


<table border="1" cellpadding="10">
<tr>
<td valign="top">
<img src="<?php echo $image1 ?>" alt="" border="0" class="large" id="largepic"><br>
<div class="itemimages">
<?php 
// image 1
if (trim(''.$image1) != '') { 
echo "<img src='";
echo $image1;
echo "' alt='' border='0'/> ";
}
// image 2
if (trim(''.$image2) != '') { 
echo "<img src='";
echo $image2;
echo "' alt='' border='0'/> ";
}
// image 3
if (trim(''.$image3) != '') { 
echo "<img src='";
echo $image3;
echo "' alt='' border='0'/> ";
}
// image 4
if (trim(''.$image4) != '') { 
echo "<img src='";
echo $image4;
echo "' alt='' border='0'/> ";
}
// image 5
if (trim(''.$image5) != '') { 
echo "<img src='";
echo $image5;
echo "' alt='' border='0'/> ";
}
// image 6
if (trim(''.$image6) != '') { 
echo "<img src='";
echo $image6;
echo "' alt='' border='0'/> ";
}
// image 7
if (trim(''.$image7) != '') { 
echo "<img src='";
echo $image7;
echo "' alt='' border='0'/> ";
}
// image 8
if (trim(''.$image8) != '') { 
echo "<img src='";
echo $image8;
echo "' alt='' border='0'/> ";
}
?>
</div>


</td>
<td valign="top">

<?php echo $title ?><br>
Estimated Value: <?php echo $value ?><br>
Item Number: <?php echo $itemnumber ?><br><br>

<?php echo $description ?><br><br>

Donated by: <?php echo $donatedby ?><br>
</td>
</tr>
</table>