PHP - A Quick Verification Please Htmlentities()

What do most people prefer to use? htmlspecialchars or htmlentities

Now, I'm trying to figure out some security factors of a website with a login etc.

Would I need to add and strip slashes if I'm using htmlentities on anything that the user enters?

I have let say Thai language and inserted into database

Code: [Select]
<b>บริษัท เอส.เค.ฟู้ดส์ (ประเทศไทย) จำกัด (มหาชน)
เป็นผู้นำเข้า-ส่งออกปลาทูน่าบรรจุกระป๋อง ต้องการรับสมัครพนักงานเพื่อรองรับการขยายกิจการ</b>
and i retrieve it using this

nl2br(htmlentities($array['message']))

the result will completely messed up as the thai language will be converted either.
if i ignore the htmlentities then i will have that message in bold

how can i achieve the result exactly the same like what has been written (message in thai language with that <b> html tag)??

thanks in advance

Does anyone have an example of when htmlentities() would be used over htmlspecialchars()?

ok here is my comment protection >< very basic and simple but i just got htmlentitied lol =[ how do i protect against that?
Code: [Select]
if (isset($_POST['submit'])) {

$comment= trim(stripslashes(mysql_real_escape_string($_POST['comment'])));
this is my registration protection, sql can still get though >< it doesnt work ?
Code: [Select]
$_POST['pass'] = md5($_POST['pass']);
  if (!get_magic_quotes_gpc()) {
  $_POST['pass'] = trim(stripslashes(mysql_real_escape_string($_POST['pass'])));
  $_POST['username'] = trim(stripslashes(mysql_real_escape_string($_POST['username'])));
  }

Hello Guys ... i am new here and i am also new in php

i selfstudy html css and js and bootstrap for front-end

and for back-back php & mysql & PDO  & OOP and  i will soon start mvc then laravel

and i am trying to secure my input field  and i do not want any attacks or sql injects

and i see people user filter_var and htmlentities and htmlspecialchars  and each one has diffrent opinion

can some one help me and tell me what is the best for securing input which all values will store in database

thanks <3

I have a function with a query and then a while loop and then an if file_exists with an image path.  I am getting the image path displayed as text.  Would this be because I am running the query through json encoding?

I have a problem which I've been trying to fix for a while now with htmlentities.

I've written my own small cms which is available for the public, and recently I recieved a report that it's vulnerable to an XSS attack:

http://host/editText.php?fieldname=slogan&content=slogan<img src=x onerror=alert("XSS")>
This vulnerability only works if the user is logged in. I want to secure it anyway to give the security companies contacting me about this a break.

I've been rolling around the internet trying to find a simple answer how to prevent this XSS attack with HTMLENTITIES.

I've even tried writing my own solutions with the htmlentities and it doesn't seem to solve the problem/stop the attack.

I'm thinking something like
htmlEntities($content); //but again, this won't do the job.

Here's the editText.php
Code: [Select]
<?php

   session_start();

function getSlug( $page ) {
   $page = strip_tags( $page );
   preg_match_all( "/([a-z0-9A-Z-_]+)/", $page, $matches );
   $matches = array_map( "ucfirst", $matches[0] );
   $slug = implode( "-", $matches );
   return $slug;
}

   $fieldname = $_REQUEST['fieldname'];
   
   $encrypt_pass = @file_get_contents("files/password");
   if ($_COOKIE['wondercms']!=$encrypt_pass)
   {
   echo "You must login before using this function!";
   exit;
   }
   
   $content = rtrim(stripslashes($_REQUEST['content']));
   // if to only allow specified tags
   if($fieldname=="title")    $content = strip_tags($content);
   else $content = strip_tags($content,"<audio><source><embed><iframe><p><h1><h2><h3><h4><h5><h6><a><img><u><i><em><strong><b><strike><center><pre>");

   $content = trim($content);
   $content = nl2br($content);

   if(!$content) $content = "Please be sure to enter some content before saving. Just type anything in here.";

   $content = preg_replace ("/%u(....)/e", "conv('\\1')", $content);

   if($fieldname>0 && $fieldname<4) $fname = "attachment$fieldname";
   else $fname = $fieldname;
   $file = @fopen("files/$fname.txt", "w");
   if(!$file)
   {
echo "<h2 style='color:red'>*** ERROR *** unable to open content_$fieldname</h2><h3>But don't panic!</h3>".
"Please set the correct read/write permissions to the files folder.<br/>
Find the /files/ folder and CHMOD it to 751.<br /><br />
If this still gives you problems, open up the /files/ folder, select all files and CHMOD them to 640.<br /><br />
If this doesn't work, contact me <a href='http://krneky.com/en/contact'>right here</a>.";
   exit;
   }
   fwrite($file, $content);
   fclose($file);

   echo $content;
   
   // convert udf-8 hexadecimal to decimal
   function conv($hex)
   {
   $dec = hexdec($hex);
   return "&#38;#$dec;";
   }
?>


There are only 3 files altogether, if someone needs index I'll post that too.

I have never looked into sanitizing before, Is using htmlentities() good enough to protect against sql injection ?

Thanks.

Hey Guys!
I would really like some feedback on the following:

I have a site in Portuguese. Php retrieves a lot of POST's with Special Characters and Portuguese Accents (which are expected).
With my sanatize function I am having some real problems with the 'htmlentities' for XSS Injection Prevention.
htmlentities is changing the accents to strange characters and messes up my database.

sanitize( &$_GET );
sanitize( &$_POST );
sanitize( &$_COOKIE );

function sanitize( &$some) 
{
$some = array_map('htmlentities', $some); //XSS Prevention

foreach( $some as $key => $value ) 
{
$value = str_replace( '--', '', $value );
$value = str_replace( '/*', '', $value );
$value = str_replace( '"', '', $value );
$value = str_replace( "'", '', $value );
$value = ereg_replace( '[\( ]+0x', '', $value );
if ($value != $some[$key]) 
{
$some[$key] = $value;
}
}
}

The only solution I can think of is to take out the 'htmlentities' function, but I would really like to have this as a prevention against XSS, is there any way around this to have both things working?

Any ideas, suggestions?

Thanks in advance!

Hi guys.   I'm using php to randomly generate a simple math verification question.  But, I'm having a hard time validating the input.  Can someone please tell me what I'm doing wrong?

Thank you
 


} else if(trim($verify) != $_SESSION['UserData']['Math'][0]+$_SESSION['UserData']['Math'][1]){
     $error = '<div class="error_message">Attention! The verification number you entered is incorrect.</div>';
}



<?php
echo "<span class='label'><span class='required'>*</span>What is ".$_SESSION['UserData']['Math'][0]." +    ".$_SESSION['UserData']['Math'][1]."?</span> ";
?>

<input name="verify" type="text" id="verify" size="3" value="<?=$verify;?>" /><br /><br />

   

I am about to build a site for a liqueur brand and have to create a simple screen that asks if the user is of the right age. This does not have to be linked to a credit card, just a simple yes or no screen. I am thinking this would probably be done via a cookie, but I am not sure.

Somehow it would have to work where it gets checked each time anyone goes to the site, regardless of the entry point. So for example it would get checked on mydomain.com, but also on mydomain.com/about, or mydomain.com/somethingelse. The yes or no screen would of course only show the first time the user came to site. Via what technology would I do this? Cookie? Can cookies have an expiration date?

I would love some comments or direction on how this is done best.

Thanks a lot!

Okay, so I'm pretty new to jQuery but I am pretty experienced with PHP.  I am about to begin coding a script written mostly in jQuery.  It will use AJAX to verify that an article tag a user provides exists in a database.  When a user goes to write an article on my website, my form will ask them to add keyword tags which will be used in searches.  Basically only admins will be allowed to create new tags, so this is why I check the tags first.  And also to prevent duplicates and similar tag entries in the database.   The form will have a single input that the user will use to search for a tag.  Once the user hits the enter key, it will search the database for tags that already exist.  Once the ajax is complete, a list of related tags will pop up and the user will be able to select their desired tag by either clicking the tag link in the list or by pressing enter.   This is a very crude demonstration of what my idea is.