PHP - Moved: A Problem With This Sanitize Message Php Code?

This topic has been moved to Ajax Help.

http://www.phpfreaks.com/forums/index.php?topic=343888.0

This topic has been moved to PHP Regex.

http://www.phpfreaks.com/forums/index.php?topic=353052.0

This topic has been moved to Miscellaneous.

http://www.phpfreaks.com/forums/index.php?topic=344720.0

This topic has been moved to JavaScript Help.

http://www.phpfreaks.com/forums/index.php?topic=347166.0

Please i need help on popup message when an image is clicked. Some one should help me with the code to place in my html document.

Folks,

Someone suggested I sanitize user inputs.
I had things like this with validation but no sanitation:

$primary_website_domain_confirmation = trim($_POST["primary_website_domain_confirmation"]); 
if (!filter_var($primary_website_email,FILTER_VALIDATE_EMAIL)) { 
            echo "You entered an Invalid Email Address!"; 

Now, got to add sanitation part. So, where to add it ?
Look at tutorial examples:
https://www.tutorialrepublic.com/php-tutorial/php-form-validation.php
https://www.w3schools.com/php/func_filter_var.asp

Latter tutorial looks simpler. Let's try copying that.
Here is my attempt ..

// Remove all illegal characters from email
$primary_website_email = filter_var(trim($email, FILTER_SANITIZE_EMAIL));
//Validate Email
if (!filter_var($primary_website_email,FILTER_VALIDATE_EMAIL)) { 
            echo "You entered an Invalid Email Address!"; 

Did I fit in the SANITIZER at the right place or not ?
Anything else need to know ? Yes ?

Cheers!

II have been told that I should sanitize my inputs, what does that mean?

Isn't that what trim does?

For some reason I commented out mysql_real_escape_string on my sanitize function, and I don't remember why I did it. Is it something that is vital and I should un-comment it out?


function sanitize($formValue){
if(function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
$formValue = stripslashes($formValue);
}
//$formValue = mysql_real_escape_string($formValue);
return $formValue;
}

I would like to sanitize input from users so when it's pulled out of the database and stuck into the page, they can't add malicous code to my page.
I have heard of striptags but wonder if there is anything better.

thanks

Folks this one line and any other variations I have tried just nulls my variable

Code: [Select]
function check_input($value)
{
echo '<pre>';
echo "Value before = ";
echo $value;
echo '</pre>';
// Stripslashes
//if (get_magic_quotes_gpc())
//   {
//   $value = stripslashes($value);
//   }
// Quote if not a number
//if (!is_numeric($value))
//   {
   $value = "'" . mysql_real_escape_string($value) . "'";   <-----
//$value = mysql_real_escape_string($value);
//$value = mysql_real_escape_string($value);
echo '<pre>';
echo "Value after = ";
echo $value;
echo '</pre>';
//   }
return $value;
 }

...
// Make a safe SQL
 $iso_code = check_input($iso_code);
 $country_name = check_input($country_name);
      $query = "select * from countries where
            iso_code = '".$iso_code."' or country like '%".$country_name."%'";
      mysql_query($query);
 echo '<pre>';
 echo $iso_code;
 echo $country_name;
 echo $query;
 echo '</pre>';
The result is:-

Code: [Select]
Value before = UK
Value after = ''
Value before = United Kingdom
Value after = ''
''''select * from countries where
            iso_code = '''' or country like '%''%'

with no mysql_real_escape statement the app work fine. I'm now trying to make my code more robust.

Any help would be appreciated.

jamie

Hi all,

I just stumbled upon the 'new' filter function of php and i was wondering if someone could maybe recommend me which to use.

for instance if i have a script:

<?php
        $_evilstring = "<script> alert('justin bieber is ruining your sound system')</script>";

        $_clean1 = htmlspecialchars($_evilstring);
        echo 'clean string one = '.$_clean1.'<br />';
        $_clean2 = filter_var($_evilstring, FILTER_SANITIZE_SPECIAL_CHARS);
        echo 'clean string two = '.$_clean2.'<br />';
        ?>


Both output exactly the same. Now i was wondering if there might be differences in them. For some reason I would like to use the filter function because the name sounds better, but that of course is not very scientific. Anyone with ideas maybe performance, speed, wickedness??

Hi everyone

I am trying to secure some of my code using a sanitize function

function sanitize($data)
{
$cdata = strip_tags(addslashes($data));
$cdata = mysql_real_escape_string($cdata);
return $cdata;
}

If I post a form value such as

Code: [Select]
'Apple iPod'
to a SQL INSERT QUERY using

`title` = sanitize($_POST['title']);

then my database value looks like

Code: [Select]
\\\'the ipod\\\'
this is odd because there is 3 slashes

if I then print that value on a PHP page using

print stripslashes($row['title']);

it outputs

Code: [Select]
\'the ipod\'
Why can I not get rid of the slashes and why would it be outputting 3 slashes?

I have tried all the magic quote ideas and suggestions, but still cannot sort this out.

Thanks

John

Os I've developed a Message board. A user writes a message and then it appears on the message board. However When the user enters a message it isn't inserted into the MySql.

Also when the messages are entered manually directly into the MySql table they dont show on the site.
Can anyone see the problem.

The code is in 3 php scripts.

messageboard.php
<?php
;
session_start();
//this checks to see if the $_SESSION variable has been not set 
//or if the $_SESSION variable has been not set to true
//and if one or the other is not set then the user gets
//sent to the login page
if (!isset($_SESSION['username'])) {
    header('Location: http://kaaleigh.byethost15.com/login.php');
}




?>




<HTML>
<head><title>Message Board - Logged In</title>
<link rel='stylesheet' href='layout.css'>
</head>
<body bgcolor="#fd8ecf">
<center><img src="headerpage.jpg"></center>

<div class="navbar">
<div class="button"><a href="index.html">Home</a></div>
<div class="button"><a href="news.html">News</a></div>
<div class="button"><a href="gallery.html">Gallery</a></div>
<div class="button"><a href="videos.html">Videos</a></div>
<div class="button"><a href="contact.html">Contact</a></div>
<div class="button"><a href="links.html">Links</a></div>
<div class="button"><a href="msg.html">Message  Kaaleigh</a></div>

</div>

<div class="frame">

<frameset cols="25%,75%" noresize="noresize">

<?php
session_start();

$username = $_SESSION['username'];
$password = $_SESSION['password'];

  if(isset($_SESSION['username']) && isset($_SESSION['password'])) {
    
  echo " <b>Welcome ".$username." <br><br></b>";
  }

    else {
    echo "Welcome Guest! <br> <a href=login.php>Login</a> | <a href=register.php>Register</a>";
    }

?>


<?php
mysql_connect("****************", "**********", "*********");
mysql_select_db("**************");
?>






<form action="message.php" method="POST">
Your Name: <input type="text" name="author"><br>
Message:<br><textarea cols="60" rows="5" name="message"></textarea><br>
<input type="submit" value="Post Message">
</form>



<hr>


<?php
// I am selecting everything from the messages section in the database and ordering them newest to oldest.
$sql = mysql_query("SELECT * FROM messages ORDER BY posted DESC");
 
// Now I am getting my results and making them an array
while($r = mysql_fetch_array($sql)) {
 
$posted = date("jS M Y h:i",$r[posted]);

// End of Array
}
?>


</body>


</html>

message.php
<?php
mysql_connect("*************", "*************", "**********");
mysql_select_db("**************");
$time = time();
mysql_query("INSERT INTO messages VALUES(NULL,'$_POST[message]','$_POST[author]','0','$time')");
echo "Message Posted.<br><a href='messageboard.php'>Return</a>";

msg.php

<?php
mysql_connect("********", "********", "*************");
mysql_select_db("**************");
echo "<a href='messageboard.php'>Go Back...</a>";
$sql = mysql_query("SELECT * FROM messages WHERE id = '$_GET[id]'");
// Now I am getting our results and making them an array
while($r = mysql_fetch_array($sql)) {
// Everything within the two curly brackets can read from the database using $r[]
// I need to convert the UNIX Timestamp entered into the database for when a thread...
// ... is posted into a readable date, using date().
$posted = date("jS M Y h:i",$r[posted]);
// Now this shows the thread with a horizontal rule after it.
echo "$r[message]<h4>Posted by $r[author] on $posted</h4><hr>";

// End of Array
}


Any thoughts?

Hey all,

While the filter itself is functioning properly, the flag doesn't seem to be.

Here's how I have it set up:

Code: [Select]

$UserInput = filter_var($UserInput , FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW); // Test Format 1

$UserInput  = filter_input(INPUT_POST, 'UserInput', FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);  // Test Format 2

As you can see, I have set up to test methods however, each one fails regarding the flag..or so it's seeming to me.

FILTER_FLAG_STRIP_LOW is supposed to strip out anything > 32 in ascii, but it isn't. '&' (38) is greater than 32 but it still displays in the browser.

Am I missing something here?

I have never looked into sanitizing before, Is using htmlentities() good enough to protect against sql injection ?

Thanks.