PHP - Filtering Metacharacters For Security

Hi, I have an issue, I cant filter my data from DB. Whats wrong in my code?
<?php
/* Include Files *********************/
//include("banners/database.php");
mysql_connect("host", "user", "pwd") or die("Connection Failed");
mysql_select_db("DB")or die("Connection Failed");
?>
<?php
$memberIndustries =['memberIndustries'];
if (isset($_POST["memberIndustries"])) {
$memberIndustries = mysql_real_escape_string ($_POST["memberIndustries"]);
$sql="SELECT * FROM Members WHERE Industries_Industry_ID='$memberIndustries'";
$result = mysql_query($sql) or die (mysql_error());
   
while ($myrowe = mysql_fetch_array($result)) {?>
   <? // if new member, label it 
   //$todays_date = date("Y-m-d");
   //$dateCompare = $myrowe[Creation_Date]+30;
   //$dateCompare = strtotime(date("Y-m-d", strtotime($myrowe[Creation_Date])) . " +30 days");
   //if(strtotime($todays_date)<=$dateCompare){
   ?>
   <table width="100%">
   <tr>
   <td align="right">
            <img src="/members/new.gif">
   </td>
   </tr>
   </table>
   <? //}?>
   
   <? if($myrowe[LOGO_lnk]!='') {?>
   <img src="<? echo $myrowe[LOGO_lnk]; ?>">
   <? } ?>
   <br /> <br /> 
   <font style="font-family: Arial; font-size: 10.5pt; font-weight:bold;color:#C1121F">
   <? echo $myrowe[Company_Title];?>
   </font>
   <? if($myrowe[Person_Name_1]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; font-weight:bold;color:#000000"><? echo $myrowe[Person_Name_1];?></font>
   <font style="font-family: Arial; font-size: 8.5pt; font-weight:bold;color:#000000"><? echo $myrowe[Person_Title_1];?></font>
   <? } 
   if($myrowe[Person_Name_2]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; font-weight:bold;color:#000000"><? echo $myrowe[Person_Name_2];?></font>
   <font style="font-family: Arial; font-size: 8.5pt; font-weight:bold;color:#000000"><? echo $myrowe[Person_Title_2];?></font>
   <? } 
   if($myrowe[Person_Name_2]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; font-weight:bold;color:#000000"><? echo $myrowe[Person_Name_3];?></font>
   <font style="font-family: Arial; font-size: 8.5pt; font-weight:bold;color:#000000"><? echo $myrowe[Person_Title_3];?></font>
   <? } 
   if($myrowe[Address_row1]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000"><? echo $myrowe[Address_row1];?></font>
   <? } 
   if($myrowe[Address_row_2]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000"><? echo $myrowe[Address_row_2];?></font>
   <? } 
   if($myrowe[Address_row_3]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000"><? echo $myrowe[Address_row_3];?></font>
   <? } 
   if($myrowe[Phone]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000">Tel:<? echo $myrowe[Phone];?></font>
   <? } 
   if($myrowe[Fax]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000">Fax:<? echo $myrowe[Fax];?></font>
   <? } 
   if($myrowe[email]!='') {?>
   <br />
   <a href="mailto:<? echo $myrowe[email];?>">
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000"><? echo $myrowe[email];?></font>
   </a>
   <? } 
   if($myrowe[web]!='') {?>
   <br />
   <a href="<? echo $myrowe[web];?>"target="_blank">
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000"><? echo $myrowe[web];?></font>
   </a>
   <? } 
   if($myrowe[Industries_Industry_ID]!=0) {
      $queryInd = "SELECT Industry_Title FROM Industries WHERE Industry_ID=$myrowe[Industries_Industry_ID]";
      $resultInd = mysql_query($queryInd) or die (mysql_error());
      $myroweIND = mysql_fetch_array($resultInd)
   ?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000"><? echo $myroweIND[Industry_Title];?></font>
   <? } 
   if($myrowe[Description]!='') {?>
   <br />
   <font style="font-family: Arial; font-size: 8.5pt; color:#000000"><? echo $myrowe[Description];?></font><p></p>
   <? } ?>
   <br /><br />
<? } 
<? }} ?>

First off, i have made a validation class using array_diff() to check if there are invalid characters submitted by a user.
Some extracts:
Code: [Select]
$this->chr_alpha_lower=array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');
$this->chr_alpha_upper=array('A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z');
$this->chr_numeric=array('0','1','2','3','4','5','6','7','8','9');
$this->chr_symbol=array(' ','!','@','#','$','%','&','(',')','[',']','.',',',':',';','\'','"','/','=','\\','-','_','?');

...

// lets say only alpha and numeric characters are allowed
$allowed_characters=array();
$allowed_characters=array_merge($allowed_characters,$this->chr_alpha_lower,$this->chr_alpha_upper);
$allowed_characters=array_merge($allowed_characters,$this->chr_numeric);

$input_split=str_split($this->input);
$invalid=array_diff($input_split,$allowed_characters);

if(empty($invalid)){
return true;
}
return false;

I have two questions.
First, for acsii characters is this method 'full proof' or is there a way for someone to get around this validation script?

Second, a new site im developing is going to be built with UTF-8 in mind so people can use the site in their own language. How do i validate UTF-8 user input? I know about mb_strings and sanitizing UTF-8 input using this:
Code: [Select]
preg_match_all('/([\x09\x0a\x0d\x20-\x7e]'. // ASCII characters
 '|[\xc2-\xdf][\x80-\xbf]'. // 2-byte (except overly longs)
 '|\xe0[\xa0-\xbf][\x80-\xbf]'. // 3 byte (except overly longs)
 '|[\xe1-\xec\xee\xef][\x80-\xbf]{2}'. // 3 byte (except overly longs)
 '|\xed[\x80-\x9f][\x80-\xbf])+/', // 3 byte (except UTF-16 surrogates)
 $input, $clean_pieces );

$clean_output = join('?', $clean_pieces[0] );

But how do i know what to filter?

Example:
a field for the user to input first name
English: only alpha characters
Other language: ?????

Help much appreciated.

Hi all,

    I am working on a tool to pull data remotely and the data is set to xml format. I want to post items that meet a certain criteria only, essentially there are several layers/tags on the data being brought over. The sStatus is the primary item I am looking for, not only that but only if it has or equals to "Waiting". Any thoughts or suggestions greatly appreciated. Below is the basic code I have in place currently and am working on.

<code>
<?php
$soapclient = new SoapClient("https://secure.logmeinrescue.com/api/api.asmx?wsdl");


$sEmail = "dummy@dum.com";
$sPassword = "dum123";
$iNodeID = "123456";   
$eNodeRef = "NODE";   
$sAuthCode = "";

$loginparams = array (
'sEmail' => $sEmail,
'sPassword' => $sPassword);

$loginResult = $soapclient->login($loginparams);

$output = array(
'eOutput' => "XML"
);

$outputResponse = $soapclient->setOutput($output);
         

$sessionparams = array(
'iNodeID' => $iNodeID,
'eNodeRef' => $eNodeRef,
'sAuthCode' => $sAuthCode
);

//get session(s)
$sessionresult = $soapclient->getSession($sessionparams);
$session = $sessionresult->aSessions;
$sessionnodes = $session->SESSION;
$session_status = $sessionnodes[$isessionNodes]->sStatus;
   
   

print_r($sessionresult);

?>
</code>

Hi there

I have the following array .

Code: [Select]
$products = array(   array( Code => "CF1",
                         Items => "Sand Tray",
                         Cat  => 'Tray',
                         ),
                  array( Code => "CF2",
                         Items => "Mobile Computer Table",
                         Cat  => 'Table',
                         ),
                  array( Code => "CF3",
                         Items => "General Service Trolley",
                         Cat  => 'Trolley',
                         ),
                  array( Code => "CF4",
                         Items => "TV Trolley",
                         Cat  => 'Trolley',
                         ),
                  array( Code => "CF5",
                         Items => "Overhead Projector Trolley",
                         Cat  => 'Trolley',
                         ),
                    array( Code => "CF6",
                         Items => "Book Trolley",
                         Cat  => 'Tolley',
                         ),
                         array( Code => "CF7",
                         Items => "Stacking Chairs",
                         Cat  => 'Chairs',
                         ),     
  ); 
What I want to do is select each by 'Cat'. For example I simply want to display all the trolleys. 

I was wondering how I do this? What functions would I use in PHP? 

Thanks a million 

This topic has been moved to PHP Regex.

http://www.phpfreaks.com/forums/index.php?topic=334433.0

Hello, Is it possible to allow '@' and '.' while maintaining the rest of this regex?

$email= 'adsfsa@asdf.edu';
$email= preg_replace("/[^A-Za-z0-9]/", " ", $email);
echo $email;

I have a SQL statement which is difficult to use PDO on, it might not even be possible to do. So I'm filtering it like this:

$search = $_GET['search'];
$search = preg_replace("/[^A-Za-z0-9]/", " ", $search);
$search = $mysqli->real_escape_string($search);

Will this result in an acceptable level of security?
Edited by anderson_catchme, 16 September 2014 - 12:28 PM.

hey guys i was generally wondering...is it good practice to add_slashes and use mysqli_real_escape_string when entering data into the database?   then to strip slashes when extracting rows?   is this the right way to go around things...thanks    

Hi guys

I was wondering if anyone could point me in the right direction with this.

I am using JSON to return the contents of a directory and then using a foreach loop to print each one to a new row in a table.

Is there anyway to filter the results? Basically I just want to show the files that end in a .jar extension? Currently all sub directories and files are shown, however all the files I need to pull will be in the main directory.

This is what I am using:

Code: [Select]
<?php
  foreach ($installedplugins1['success'] as $v) 
{
echo "<tr><td>".$v."</td>";
echo "<td><a href='index.php?dp=".$v."'>Disable Plugin</a></td>";

}
?>

Any hints or reading material?

Cheers

I want to create a feature as you see nn this image, where it says 'filter your results' if a user clicks 'Detached Houses' then only detached houses will be displayed. if a user clicks 'Semi-detached' then only semi detached houses will be shown.
Any help is really appreciated, thank you.
Code: [Select]

<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><div id="filter"><p class="houses" style="font-family:helvetica;color:#0155a1;font-size:14px;background:url(cutouts/forsale/filter.jpg) no-repeat;"><b><u>Houses</u></b>
<br />
<span class="dh"><b><u>Detached Houses</u></b></span><?php
// Make a MySQL Connection
mysql_connect("localhost", "admin", "1admin") or die(mysql_error());
mysql_select_db("test") or die(mysql_error());

// Get a specific result from the "example" table
$result = mysql_query("SELECT * FROM example
 WHERE name='Sandy Smith'") or die(mysql_error());  

// get the first (and hopefully only) entry from the result
$row = mysql_fetch_array( $result );
// Print out the contents of each row into a table 
echo $row['name']." - ".$row['age'];
?>
<br />
<span class="dh"><b><u>Semi-detached houses</u></b></span>
<br />
<span class="dh"><b><u>Terraced houses</u></b></span>
<br />
<br />
<b><u>Flats / Apartments</u></b>

</p></div></td>
 

Hey guys, we have a website where people are able to post things, and we don't want to allow anyone to be able to post their street address, for obvious reasons. I'm really stuck on this one, I've looked for some regular expressions to no avail...one idea we did have was to check a text for an address then check to see if it was a valid address with the google maps API but then again...it goes back to having a regular expression for capturing the street address. I was wanting to know, is there any way I will be able to catch whether a user has posted an address? I was going to post this in the regex section but I'm not sure if I should use any regex's or if there might be another way.

Put basically I need to be able to strip a street address from the text if a user posts one.

I'm pretty sure it's probably not possible, but I figured I'd ask first. Thanks for any help anyone can provide!

I'm trying to firstly generate all possible 'x' number combinations from an array of 'y' numbers. i.e. combinations of 3 numbers from array(1,2,3,4,5). so... 1,2,3 - 1,2,4 - 1,2,5, 1,3,4 etc
I then want to be able to filter out duplicate permutations. i.e. 1,2,3 is the same as 1,3,2.

I have googled vigorously but not been able to determine a suitable approach.

Any suggestions would be appreciated.

Thanks.

Hi Everybody,

I think it's fairly simple, but i am a noob in PHP so need help from advanced coders.

I have MySQL table which is being filled up everyday, there are 7 fields in the table (submitter, choosebank, choosetype, ampaid, amret, date, descript).
What I need is to create a search.php which will be looking up data in all fields and printing it on the screen and the search should be filtered. What I mean is when a user wants to search for data let's say using submitter  who's name is Mitchel then it should search for all data and print all rows containing submitter (Mitchel) and the rest six fields. And if user searches let's say using submitter (Mitchel) and a certain date (let's say DEC-25-2011) then it should find all data containing Mitchel and DEC-25-2011 in the same row and print all rows which contain the same search parameter and the rest of the fields.

Any help would be greatly appreciated!

Here is the code I have so far, but it doesn't work.

<code>

<?php

include ("blocks/db.php");

$sql = mysql_query("SELECT * FROM banks WHERE submitter LIKE '$sub' or choosebank LIKE '$bank' or choosetype LIKE '$type' or $money_column LIKE '$money_column' or $money_value LIKE '$money_amount' or inputdate LIKE '$inputdate' or descript LIKE '$descript'") or die(mysql_error());

echo "<table width='1000' border='1' cellspacing='0' cellpadding='1'>";
 echo "<tr>";
 echo "<td width='100'>Submitter</td>";
 echo "<td width='90'>Bank</td>";
 echo "<td width='110'>Type of Payment</td>";
 echo "<td width='110'>Amount Paid</td>";
 echo "<td width='110'>Amount Returned</td>";
 echo "<td width='100'>Date</td>";
 echo "<td width='366'>Description</td>";
 echo "</tr>";
echo "</table>";

while ($row = mysql_fetch_array($sql)){

echo "<table width='1000' border='1' cellspacing='0' cellpadding='1'>";
 echo "<tr>";
 echo "<td width='100'>$row[submitter]</td>";
 echo "<td width='90'>$row[choosebank]</td>";
 echo "<td width='110'>$row[choosetype]</td>";
 echo "<td width='110'>$row[ampaid]</td>";
 echo "<td width='110'>$row[amret]</td>";
 echo "<td width='100'>$row[date]</td>";
 echo "<td width='366'>$row[descript]</td>";
 echo "</tr>";
echo "</table>";

}

?>

</code>

I'm using an INNER JOIN to grab some data from 2 tables depending on if another's id matches an id within the other table (obviously..  ).

Is there anyway to continue on with this join but to filter even deeper by only taking data that not only has matching some_id but also does not have a row that equals a certain value?

Something along the lines of adding "WHERE some_row != 'value'" ?

"SELECT * FROM my_firstTable INNER JOIN my_secondTable ON my_firstTable.some_id = my_secondTable.some_id ORDER BY my_firstTable.some_id"

Hi all

I am building a page to filter SQL values but I'm not sure how to write the code for the query.

My URL looks like this:

stone.php?category=Wood&type=4&colour=1&Submit=Submit

Firstly, can I remove the submit from the URL?

Then I have my code to create the query:

$fetchData=mysql_query("SELECT * FROM `products` WHERE category = "'.$_GET'category.'"");

Can I combine this for the type and colour?

Many thanks
Pete