PHP - Checking For Illegal Characters In An Input

Hi all,

I'm working on this site which I'll soon ask the guys in the testing forum to have a peek at.  It's essentially an online community that was a uni project that has spiraled and grown exponetially.

I've spent many many hours in front of books and tutorals etc to put it together and as far as scripting goes, it seems to be fine.  The problem i'm having...The tut's that I read / watched were using eregi_replace to protect text fields and this is now unsuported.

I want my site to be as secure as it can be, within reason.

I've tried using preg_replace instead and have searched for the syntax but i keep getting strang results.
I'm working on the "bio" field at the moment and then when that works I can move on and a-ply the same idea to the other fields.

This si what I have and what I've changed.
if ($_POST['parse_var'] == "bio"){
   
    $bio_body = $_POST['bio_body'];
    //$bio_body = str_replace("'", "'", $bio_body);  (WAS TESTING THIS BUT NO JOY)
    //$bio_body = str_replace("`", "'", $bio_body);
         $bio_body = mysql_real_escape_string($bio_body);
         $bio_body = nl2br(htmlspecialchars($bio_body));

        $bio = $_POST['bio'];
   $bio = eregi_replace("'", "'", $bio);           (This works but is not as secure)
   $bio = eregi_replace("`", "'", $bio);
        $bio = mysql_real_escape_string($bio);
        $bio = nl2br(htmlspecialchars($_POST['bio']));

        $sqlUpdate = mysql_query("UPDATE members SET bio='$bio' WHERE id='$id'");
       and so on....}


When I change it to str_replace if I type in don't the whole word is deleted.  when I type in preg I get an error.
Can someone please give me the correct code / syntax for getting the result I want.

I just want to make sure that every single field that has a user input is protected against any malicious attacks.
Thanks.

Hey I wasn't able to add/edit some text to the mysql database because of some character
how can i bypass them
 should i use the mysql_real_escape_string() ? if yes how do i make it work with the code i got?

thaks

<?php
include "../configdb.php";

$id = $_GET['id'];
if(isset($_POST['submit']))
{
    //global variables
$name = $_POST['name'];
$footer = $_POST['footer'];


//run the query which adds the data gathered from the form into the database    
$result = mysql_query("UPDATE pages SET name='$name', footer='$footer' WHERE id='$id' ",$connect);
echo "<b>Your Page have been edited successfully";
// echo "<meta http-equiv=Refresh content=2;url=index.php>";
}
elseif($id)
{
$result = mysql_query("SELECT * FROM pages WHERE id='$id' ",$connect);
        while($row = mysql_fetch_assoc($result))
{
 ?>

<h3>::Edit Page</h3>
<form method="post" action="<?php echo $_SERVER['PHP_SELF'] ?>?id=<?php echo $row['id']?>">
<input type="hidden" name="id" value="<?php echo $row['id']?>">
<textarea name="name"><?php echo $row['name']?></textarea>
<input name="footer" size="40" maxlength="255" value="<?php echo $row['footer']?>">
<input type="submit" name="submit" value="Submit">       

     
      <?php
}
}
?>

So basically I have a site, and on that site, I have a page that submits a form and updates a database. I have it set up so that someone can enter in Multiple values into a textarea, one on each line, and it will submit each of those values as a new row in the database, but for the life of me, I cannot figure out how to check those values against the actual users.

It is basically a point system, where the staff can award points users of the site. But at the moment, a Staff member could enter in Jibberish, and it would insert that into the database, but I want it to check my users table to make sure the user exists before it inserts it into the database.

here is my code:
<?php
include 'global.php';

echo $headersidebar;


if ($_COOKIE['access'] == $accessstaff)
{





if(count($_POST))
{



$array = preg_split('/(\r?\n)+/', $_POST['studentname']);
foreach($array as $students)
   {
   
   $statusmsg = '<center><span style="background: #A6FF9E;">You have successfully submitted points to the database.</span></center>';
   
   mysql_query("INSERT INTO points (giver, receiver, points, category, reason, date, status) VALUES ('{$_COOKIE['username']}', '{$students}', '{$_POST['pointamt']}', '{$_POST['pointcat']}', '{$_POST['pointreason']}', '{$date}', 'Validating')");
   }
}


$addpointspage = $statusmsg . '

<form action="submit_points.php" method="post">

<table class="table" >

<tr>

<td colspan="10">

<h1><strong><center>Submit Points</center></strong></h1>

</td>

</tr>

<tr>

<td colspan="10" rowspan="100">

<center>Please remember to follow the house point limits when submitting house points.</center>

</td>

</tr>

</table>

<table class="table">

<tr>

<td style="width: 15%;" valign="top">

Student Name:<br> <span style="font-size: 60%;">(List as many as you want; One per Line)</span>

</td>

<td colspan="10">

<center><textarea name="studentname" cols="60" rows="10"></textarea></center>

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Amount of Points:

</td>

<td>

<input style="position: relative; left: 16px;" type="text" size="15" name="pointamt" />

</td>

<td>

Do not put anything that is not a number into this box.

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Point Category:

</td>

<td colspan="10">

<select name="pointcat" style="position: relative; left: 16px;">

<option SELECTED value="">-------</option>

<option>Class Work</option>

<option>Class Exam</option>

<option>Extra Work</option>

<option>Contests</option>

<option>Teacher\'s Assistant</option>

<option>Negative Points</option>

</select>

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Reason:

</td>

<td colspan="10">

<input style="position: relative; left: 16px;" name="pointreason" type="text" size="80" />

</td>

</tr>

<tr>

<td>

</td>

<td colspan="10">

<input style="position: relative; left: 16px;" type="submit" value="Submit Points" />

</td>

</tr>

</table

</form>



';

}

elseif (1==1)
{
$addpointspage = $accessdenied;
}



echo

'

<!-- start content -->

<div id="content">

<div class="post">

<div class="entry">

<p><strong>' . $addpointspage . '</p>

<p class="links">' . $addpointslink . '</p>

</div>

</div>

</div>

<!-- end content -->

<div style="clear: both;">&nbsp;</div>

</div>

<!-- end page -->
</div>';








echo $footer;





?>


I am fairly new to PHP, so I would appreciate any help someone could give me; I am not too good with arrays and such, so this one has got me stumped.

Hey guys and gals!

This is my first post here and needing a bit of help with my php code! So here is the deal, i have 3 tables in ms sql 2000 which i will be using on this project.

i have an employee table that has the regular information such as:

TABLE employee( uniqueid, employee_number, lastname, firstname, dob, address, city, state, zip )

TABLE employee_docs( uniqueid, employee_number, doc_type int, date_received, date_issued, date_expired )

TABLE doc_type(uniqueid, description, valid_month)


so basically from the employee_doc table, the doc_type column is an int and will have the description of the document as well as valid month column which will tell you how long the document type is valid until. the Description gives a brief description of what the product is. The uniqueid is used as what ever number is chose from the employee_docs table will represent the document type from table doc_type.

ok so now that i gave a brief explanation of the tables i am working with, I can tell you what i need.

i need a php page that will display:

employee number, lastname, firstname, doc_type, date_received, date_issued, date_expired.

Code: [Select]
select pn.empnum as employeeid, (pn.lastname + ', ' +  pn.firstname)as [Full Name],
dt.description as doc_type,
formatDate(pd.received) as [Date Received],
formatDate(pd.expired)as [Date Expired],
formatDate(pd.issued) as [Date In Service]

from personnel_document pd
left join document_types dt on (dt.uniqueid = pd.doc_type)
left join personnel pn on (pd.empnum = pn.empnum)

where pd.empnum = '$EmpNum'
now, I went ahead and did this for the html part:
 
Code: [Select]
<table border=0>
           
            <tr>
                    <td height=20px weight=1px valign=bottom><span class=underline>DESCRIPTION</span></td>
                            <td height=20px weight=1px valign=bottom><span class=underline>DATE RECEIVED</span></td>
                            <td height=20px weight=1px valign=bottom><span class=underline>LICENSE NUMBER</span></td>
                    <td height=20px weight=1px valign=bottom><span class=underline>DATE IN SERVICE</span></td>
                            <td height=20px weight=1px valign=bottom><span class=underline>DATE EXPIRED</span></td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>PHYSICAL EXAM</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_dr id=phexam_dr onBlur= 'formatDate(this)' value='<?php echo $phexam_dr;  ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_ln id=phexam_ln onBlur='formatDate(this)' value='<?php echo $phexam_ln;                              ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_is id=phexam_is onBlur= 'formatDate(this)' value='<?php echo $phexam_is;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= phexam_ex id=phexam_ex onBlur='formatDate(this)' value='<?php echo $phexam_ex;                             ?>'>&nbsp;</td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>PROFESSIONAL LICENSE</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_dr id=prolic_dr onBlur='formatDate(this)' value='<?php echo $prolic_dr;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_ln id=prolic_ln onBlur='formatDate(this)' value='<?php echo $prolic_ln;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_is id=prolic_is onBlur='formatDate(this)' value='<?php echo $prolic_is;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= prolic_ex id=prolic_ex onBlur='formatDate(this)' value='<?php echo $prolic_ex;                              ?>'>&nbsp;</td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>PROFESSIONAL INSURANCE</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_dr id=proins_dr onBlur='formatDate(this)' value='<?php echo $proins_dr;                            ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_ln id=proins_ln onBlur='formatDate(this)' value='<?php echo $proins_ln;      ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_is id=proins_is onBlur='formatDate(this)' value='<?php echo $proins_is;   ?>'>&nbsp;</td>
                            <td valign=top><input class=demog_box type=text size=10 name= proins_ex id=proins_ex onBlur='formatDate(this)' value='<?php echo $proins_ex;   ?>'>&nbsp;</td>
                    </tr>
                    <tr>
                    </tr>
                    <tr>
                            <td height=20px valign=bottom><span class=label_text>DRIVER'S LICENSE</span></td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_dr id=dl_dr onBlur='formatDate(this)' value='<?php echo $dl_dr; ?>'>&nbsp;
                            </td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_ln id=dl_ln onBlur='formatDate(this)' value='<?php echo $dl_ln; ?>'>&nbsp;
                            </td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_is id=dl_is onBlur='formatDate(this)' value='<?php echo $dl_is; ?>'>&nbsp;
                            </td>
                            <td valign=top><input class=demog_box type=text size=10 name=dl_ex id=dl_ex onBlur='formatDate(this)' value='<?php echo $dl_ex; ?>'>&nbsp;
                            </td>
    </tr>
                    <tr>
                    </tr>
                    <tr>

</table>

I am now doing the the sql statement to insert into my db but i am stuck.
i basically want to get the information that the user enters for each field and save it on the employees profile.

$querydoc = "update    personnel_document
                      set empnum = '$EmpNum' , doc_type = ???, date_received = ????, date_expired = ????, date issued = ???
         where empnum = '$EmpNum' ";

The problem is that since each description has a different variable im not sure how to update it.... would I have to create a new update for each description? also I hard coded the name of each description but i believe it is better if i echo the description name from the db as i cant use taht as the doc_type... i am pretty confused, if anyone has a better way of doing this i would really appreciate it!

eventually i also want to make sure that the description is expired to to with the fields I have there and promp the user of something that is expired. Once again, any help given is much appreciated!!!

Set up:
    * XAMPP 1.7.3
    * Apache 2.2.14 (IPv6 enabled) + OpenSSL 0.9.8l
    * MySQL 5.1.41 + PBXT engine
    * PHP 5.3.1
    * phpMyAdmin 3.2.4
    * Perl 5.10.1
    * FileZilla FTP Server 0.9.33
    * Mercury Mail Transport System 4.72

I'm trying to set up a multipage registration script. It's tuff! I've set up some basic scripts to distribute variables into the correct tables from previous forms using a session. But I want the script to check the input from form one is valid before it moves on to form 2.

Here are my scripts:
form 1:

<html>
 <head>
  <title>Register</title>
  <style type="text/css">
   td { vertical-align: top; }
  </style>
 </head>
 <body>
  <form action="form2.php" method="post">
   <table>
    <tr>
     <td><label for="name">Username:</label></td>
     <td><input type="text" name="name" id="name" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>
     <td><label for="password">Password:</label></td>
     <td><input type="password" name="password" id="password" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>    
     <td><label for="first_name">First name:</label></td>
     <td><input type="text" name="first_name" id="first_name" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>
     <td><label for="last_name">Last name:</label></td>
     <td><input type="text" name="last_name" id="last_name" size="20"
       maxlength="20" value=""/></td>
    </tr><tr>
     <td><label for="email">Email:</label></td>
     <td><input type="text" name="email" id="email" size="20" maxlength="50"
       value=""/></td>
    </tr><tr>
     <td><label for="address">Address:</label></td>
     <td><input type="text" name="address" id="address" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
     <td><label for="city">City/Town:</label></td>
     <td><input type="text" name="city" id="city" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="county">County:</label></td>
     <td><input type="text" name="county" id="county" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="post">Postcode:</label></td>
     <td><input type="text" name="post" id="post" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="home">Home Number:</label></td>
     <td><input type="text" name="home" id="home" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
 <td><label for="mobile">Mobile:</label></td>
     <td><input type="text" name="mobile" id="mobile" size="20" maxlength="20"
       value=""/></td>
    </tr><tr>
     <td> </td>
     <td><input type="submit" name="submit" value="Sumbit"/></td>
    </tr>
   </table>
  </form>
 </body>
</html>


Form 2:

<?php

//let's start the session
session_start();

//now, let's register our session variables
session_register('name');
session_register('password');
session_register('first_name');
session_register('last_name');
session_register('email');
session_register('address');
session_register('city');
session_register('county');
session_register('post');
session_register('home');
session_register('mobile');

//finally, let's store our posted values in the session variables
$_SESSION['name'] = $_POST['name'];
$_SESSION['password'] = $_POST['password'];
$_SESSION['first_name'] = $_POST['first_name'];
$_SESSION['last_name'] = $_POST['last_name'];
$_SESSION['email'] = $_POST['email'];
$_SESSION['address'] = $_POST['address'];
$_SESSION['city'] = $_POST['city'];
$_SESSION['county'] = $_POST['county'];
$_SESSION['post'] = $_POST['post'];
$_SESSION['home'] = $_POST['home'];
$_SESSION['mobile'] = $_POST['mobile'];

?>

<html>
 <head>
  <title>Register</title>
  <style type="text/css">
   td { vertical-align: top; }
  </style>
 </head>
 <body>
  <form action="form3.php" method="post">
   <table>
    <tr>
     <td><label for="bio">Biography:</label></td>
     <td><input type="text" name="bio" id="bio" size="400"
       maxlength="500" value=""/></td>
    </tr><tr>    
     <td> </td>
     <td><input type="submit" name="submit" value="Sumbit"/></td>
    </tr>
   </table>
  </form>
 </body>
</html>



I've also got form3.php and process_forms.php(that's where I mysql_real_escape_string and input the data) but that's probably not relevant. How would I get this to work? Are there any sites I should look at that you'd recommend? Any help appreciated.