PHP - Users Posting Html Concerns

My employer asked if I could change an existing contact form on their website to allow clients to enter their Social Security Number along with the normal contact information if the client decide to do so, instead of going through the motion of physically send in the form via snail mail, fax, or in person (like it is currently handled).
But since this piece of information is of such delicate nature, I wonder how I should approach this from both a legal standpoint and from a programming standpoint.
The form currently sends the information entered by the user to an inbox with mail(), so my initial thought was to somehow encrypt the information, limiting the risk of someone getting a hold of this information once the use user clicks "Send". But is full blown SSL really necessary for this? Are there easier options? And what should I think about before enabling this?

I have a file on my server that I will stream to the browser:

header( "Content-Description: File Transfer" );
header( "Content-Type: application/force-download");
header( "Content-Length: " . filesize( $filename ) );
header( "Content-Disposition: attachment; filename=$filename");
readfile( $filename );


$filename is going to be in a location that's not publicly available (there's no URL to it, as it's on the server, and not within public_html or subdirectories).

Any safety concerns here? Basically, I'm just curious if a user has any way to steal the file or otherwise access the directory. I don't think so, but I'm just tossing this out here as a general discussion.

Thanks!

Hi friends,    Another security issue but this time its regarding outputting data from a DB to a browser. Please have a look at the code below which displays some output fetched from a DB and sends it to a browser.    1. If I just wish to display this output on a screen and not provide the user with any buttons or hyperlinks to interact with the information, would I still need to sanitize the output before echoing it to the screen ?    2. If I was to make at least one of the fields a hyperlink, so that I could then display some related information on another webpage, what security concerns would I need to address in my code?   3. If I was to add a button against each of these records, on each row, and then select some related  information on another webpage after processing the button handler, what would be the security concerns that I should address for the code below.    Thanks very much.

<table>

<tr>
<th> S.No. </th>
<th> Name </th>
<th> Age </th>
<th> City </th>
<th> Cell </th>
<th> Email</th>
</tr>

<?php 
$cnt = 1;
while ($row = mysqli_fetch_array($result, MYSQLI_ASSOC))
{
echo "<tr>";
echo "<td>".$cnt++."</td>";
echo "<td>".$row['Name']. "</td>";
echo "<td>".$row['Age']. "</td>";
echo "<td>".$row['City']. "</td>";
echo "<td>".$row['Cell']. "</td>";
echo "<td>".$row['Email']. "</td>";
echo "</tr>";
}
?>
</table>

hi, I'm working with a script I've written (with a *lot* of help!!) I'm trying to get the results of a db search to be displayed in a html table, with a row for each result. I'm almost there, I've got 1 glitch and 1 cosmetic issue I can't resolve with the below script, any help would be greatly appreciated!!

1. the table displays the entire contents of the db before it is filtered through the search, I think this has something to do with the $num=mysql_numrows($result); expression, but I'm not sure how to fix it

2. I'd like the last column of the table to be about twice as wide as the others, as it contains a lot of free text, would I have to set the length of each column in order to do this or is there a shorthand way?

the current script is:

<form method="post" name="Search" action="test2.php">
<input type="text" name="name" autocomplete="OFF" />
<input value="Search" type="submit" name="Search" />
<input value="yes" type="hidden" name="submitted" />
</form>


<?php
if($_POST['submitted'] == 'yes')

$username="*****";
$password="*****";
$database="*****";
$server="localhost";
$db_handle = mysql_connect($server, $user_name, $password);
$db_found = mysql_select_db($database, $db_handle) or die( "Unable to select database");


$query="SELECT * FROM ***** WHERE surname LIKE '" . mysql_real_escape_string($_POST['name']) . "%'";
$result=mysql_query($query) or die ('<br>Query string: ' . $SQL . '<br>Produced error: ' . mysql_error() . '<br>');

if (mysql_num_rows($result) == 0) {
echo "No results found";
exit;
}

$num=mysql_numrows($result);


$fields_num = mysql_num_fields($result);
echo "<h1>Table: {$table}</h1>";
echo "<table border='1'><tr>";
for($i=0; $i<$fields_num; $i++)
{
    $field = mysql_fetch_field($result);
    echo "<td>{$field->name}</td>";
}
echo "</tr>\n";

while($row = mysql_fetch_row($result)){
    echo "<tr>";
foreach($row as $cell)
        echo "<td>$cell</td>";
    echo "</tr>\n";
}
mysql_free_result($result);
mysql_close($db_handle);
?>

Just a heads up, my OOP skills are in development so sorry for the roughness of things...(any tips always appreciated!)

I'm basically making my own little repository site that will have snippets (for quick copy paste anywhere) (I know there are other services, but mine is a little different and needs to be private).

I'll try to just post the necessary code:

HTML trying to pass:
Code: [Select]
<p><br /><span class="something">Hey buddy</span></p>
Javascript/JQuery:
Code: [Select]
//send info
$.ajaxFileUpload({
url:'./upload_zip.php',
secureuri:false,
fileElementId:'form_zip',
dataType: 'json',
data: {...
'description': htmlEntities($('#modularContent form textarea[name="description"]').val())...},
success:function(data, status){
var html = ...
html+= ...'<div class="description"><p>'+data.description+'<br /><br />';...
$('#list').append(html);
...
$('#modularOverlay,#modularContent').remove();
},
error:function(data, status, e){
alert(e);
} 

...
function htmlEntities(str) {
    return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
}
//found via: http://css-tricks.com/snippets/javascript/htmlentities-for-javascript/

PHP:
Code: [Select]
<?php
//Start object and modify initial values
public function __construct($title,$description,$url,$snippet){
...
if($this->snippet == 'yes'){
$this->handle_snippet();
}
}
public function handle_snippet(){
$code = htmlentities($this->description, ENT_QUOTES | ENT_IGNORE, 'UTF-8',false);
$this->description = $code;
}
//returning value
public function getJSON($action){
//temp fix for js breaking if  remove_tag_ids is empty/null
if(empty($this->remove_tag_ids)){
$this->remove_tag_ids = 'null';
}
if($this->snippet == 'yes'){
$this->description = stripslashes($this->description);
}
switch($action){
case 'delete':
//not important
default:
$json = array(...'description'=>$this->description...);
break;
return $json;
}
?>

POST Value: (via firebug)
Code: [Select]
description: <p><br /><span class="something">Hey buddy</span></p>
JSON Return value: (via firebug)
Code: [Select]
description: &lt;p&gt;&lt;br /&gt;&lt;span class=&quot;something&quot;&gt;Hey buddy&lt;/span&gt;&lt;/p&gt;
DB value:
Code: [Select]
&lt;p&gt;&lt;br /&gt;&lt;span class=\&quot;something\&quot;&gt;Hey buddy&lt;/span&gt;&lt;/p&gt;
As far as error, I have no idea what the error is haha. It does not get through to the error code cause the plugin tosses an error b4 that (using an ajaxUpload plugin http://www.phpletter.com/Our-Projects/AjaxFileUpload/, (this does not affect the upload, it uploads just fine, but it tosses an error for some reason)).

Anyone have any insights/ideas?
Thanks for any and all help,
Justin