PHP - Htmlentities Running When Not Wanted

Now, I'm trying to figure out some security factors of a website with a login etc.

Would I need to add and strip slashes if I'm using htmlentities on anything that the user enters?

Think i've got my self a little confused here.

htmlentities 

This function is designed to try and keep clients safe.

If the comment the user inputs can only ever be seen by him or her, then in theory is there no need to use htmlentities as any dodgy script would only affect them.

Is this correct thinking?

Hi all i was just trying to test out what the effect is of htmlentities() and htmlspecialchars() with an without ENT_QUOTES, but it looks like it's not working as expected. I made a small script to compare the 2 the only thing happends that javascript isn't executed, but i though it would convert special characters into even more special ones

I am running on xampp btw if that helps

$plain_input = "I am going to hax0r your site, hahaha!
    <script type='text/javascript'>
    window.location = 'http://www.google.com/'
    </script>";

     $plain_input2 = htmlentities($plain_input);
     $plain_input2_ent = htmlentities($plain_input,ENT_QUOTES);
        echo '<b>htmlentities: </b>'.$plain_input2.'<br />';
        echo '<b>htmlentities + entquotes: </b>'.$plain_input2_ent.'<br />';
        echo '<hr /><br />';

     $plain_input3 = htmlspecialchars($plain_input);
     $plain_input3_ent = htmlspecialchars($plain_input,ENT_QUOTES);
        echo '<b>htmlspecialchars:</b> '.$plain_input3.'<br />';
        echo '<b>htmlspecialchars + entquotes:</b> '.$plain_input3_ent.'<br />';
        echo '<hr /><br />';


this just outputs:
Code: [Select]
htmlentities: I am going to hax0r your site, hahaha! <script type='text/javascript'>  window.location = 'http://www.google.com/' </script>
htmlentities + entquotes: I am going to hax0r your site, hahaha! <script type='text/javascript'> window.location = 'http://www.google.com/' </script>

htmlspecialchars: I am going to hax0r your site, hahaha! <script type='text/javascript'> window.location = 'http://www.google.com/' </script>
htmlspecialchars + entquotes: I am going to hax0r your site, hahaha! <script type='text/javascript'> window.location = 'http://www.google.com/' </script>

Hello Guys ... i am new here and i am also new in php

i selfstudy html css and js and bootstrap for front-end

and for back-back php & mysql & PDO  & OOP and  i will soon start mvc then laravel

and i am trying to secure my input field  and i do not want any attacks or sql injects

and i see people user filter_var and htmlentities and htmlspecialchars  and each one has diffrent opinion

can some one help me and tell me what is the best for securing input which all values will store in database

thanks <3

So, If I want to store something like:

Code: [Select]
Hello<br />
<b>This is a sentence </b>
I would need to use
htmlentities()

So I could output the HTML after it's stored in the database safely?

I have a function with a query and then a while loop and then an if file_exists with an image path.  I am getting the image path displayed as text.  Would this be because I am running the query through json encoding?

Does anyone have an example of when htmlentities() would be used over htmlspecialchars()?

ok here is my comment protection >< very basic and simple but i just got htmlentitied lol =[ how do i protect against that?
Code: [Select]
if (isset($_POST['submit'])) {

$comment= trim(stripslashes(mysql_real_escape_string($_POST['comment'])));
this is my registration protection, sql can still get though >< it doesnt work ?
Code: [Select]
$_POST['pass'] = md5($_POST['pass']);
  if (!get_magic_quotes_gpc()) {
  $_POST['pass'] = trim(stripslashes(mysql_real_escape_string($_POST['pass'])));
  $_POST['username'] = trim(stripslashes(mysql_real_escape_string($_POST['username'])));
  }

I have a problem which I've been trying to fix for a while now with htmlentities.

I've written my own small cms which is available for the public, and recently I recieved a report that it's vulnerable to an XSS attack:

http://host/editText.php?fieldname=slogan&content=slogan<img src=x onerror=alert("XSS")>
This vulnerability only works if the user is logged in. I want to secure it anyway to give the security companies contacting me about this a break.

I've been rolling around the internet trying to find a simple answer how to prevent this XSS attack with HTMLENTITIES.

I've even tried writing my own solutions with the htmlentities and it doesn't seem to solve the problem/stop the attack.

I'm thinking something like
htmlEntities($content); //but again, this won't do the job.

Here's the editText.php
Code: [Select]
<?php

   session_start();

function getSlug( $page ) {
   $page = strip_tags( $page );
   preg_match_all( "/([a-z0-9A-Z-_]+)/", $page, $matches );
   $matches = array_map( "ucfirst", $matches[0] );
   $slug = implode( "-", $matches );
   return $slug;
}

   $fieldname = $_REQUEST['fieldname'];
   
   $encrypt_pass = @file_get_contents("files/password");
   if ($_COOKIE['wondercms']!=$encrypt_pass)
   {
   echo "You must login before using this function!";
   exit;
   }
   
   $content = rtrim(stripslashes($_REQUEST['content']));
   // if to only allow specified tags
   if($fieldname=="title")    $content = strip_tags($content);
   else $content = strip_tags($content,"<audio><source><embed><iframe><p><h1><h2><h3><h4><h5><h6><a><img><u><i><em><strong><b><strike><center><pre>");

   $content = trim($content);
   $content = nl2br($content);

   if(!$content) $content = "Please be sure to enter some content before saving. Just type anything in here.";

   $content = preg_replace ("/%u(....)/e", "conv('\\1')", $content);

   if($fieldname>0 && $fieldname<4) $fname = "attachment$fieldname";
   else $fname = $fieldname;
   $file = @fopen("files/$fname.txt", "w");
   if(!$file)
   {
echo "<h2 style='color:red'>*** ERROR *** unable to open content_$fieldname</h2><h3>But don't panic!</h3>".
"Please set the correct read/write permissions to the files folder.<br/>
Find the /files/ folder and CHMOD it to 751.<br /><br />
If this still gives you problems, open up the /files/ folder, select all files and CHMOD them to 640.<br /><br />
If this doesn't work, contact me <a href='http://krneky.com/en/contact'>right here</a>.";
   exit;
   }
   fwrite($file, $content);
   fclose($file);

   echo $content;
   
   // convert udf-8 hexadecimal to decimal
   function conv($hex)
   {
   $dec = hexdec($hex);
   return "&#38;#$dec;";
   }
?>


There are only 3 files altogether, if someone needs index I'll post that too.

I have never looked into sanitizing before, Is using htmlentities() good enough to protect against sql injection ?

Thanks.

Hey Guys!
I would really like some feedback on the following:

I have a site in Portuguese. Php retrieves a lot of POST's with Special Characters and Portuguese Accents (which are expected).
With my sanatize function I am having some real problems with the 'htmlentities' for XSS Injection Prevention.
htmlentities is changing the accents to strange characters and messes up my database.

sanitize( &$_GET );
sanitize( &$_POST );
sanitize( &$_COOKIE );

function sanitize( &$some) 
{
$some = array_map('htmlentities', $some); //XSS Prevention

foreach( $some as $key => $value ) 
{
$value = str_replace( '--', '', $value );
$value = str_replace( '/*', '', $value );
$value = str_replace( '"', '', $value );
$value = str_replace( "'", '', $value );
$value = ereg_replace( '[\( ]+0x', '', $value );
if ($value != $some[$key]) 
{
$some[$key] = $value;
}
}
}

The only solution I can think of is to take out the 'htmlentities' function, but I would really like to have this as a prevention against XSS, is there any way around this to have both things working?

Any ideas, suggestions?

Thanks in advance!

Hi,

I am getting un-wanted error messages with this register form. It should just go through to insert into db table but i keep getting:

"You must enter a valid address
Your invalid company description was:"

Here's the code.... register00.php:

Code: [Select]
<?PHP
session_start();
include('db.php');
/* set some validation variables */
if (isset($_POST['Submit'])){
$error_message = "";

/* DEFINE THE FUNCTION */
/* ============================================== */
/* ============================================== */
/* DO NOT MODIFY THIS FUNCTION */
function Resize_Image($save,$file,$t_w,$t_h,$s_path,$o_path) {
$s_path = trim($s_path);
$o_path = trim($o_path);
$save = $s_path . $save;
$file = $o_path . $file;
// $ext = strtolower(end(explode('.',$save)));
$a = explode('.', $save);
$ext = strtolower(end($a)); unset($a);

list($width, $height) = getimagesize($file) ;
if(($width>$t_w) OR ($height>$t_h)) {
$r1 = $t_w/$width;
$r2 = $t_h/$height;
if($r1<$r2) {
  $size = $t_w/$width;
}else{
  $size = $t_h/$height;
}
}else{
$size=1;
}
$modwidth = $width * $size;
$modheight = $height * $size;
$tn = imagecreatetruecolor($modwidth, $modheight) ;
switch ($ext) {
case 'jpg':
case 'jpeg':
$image = imagecreatefromjpeg($file) ;
break;
case 'gif':
$image = imagecreatefromgif($file) ;
break;
case 'png':
$image = imagecreatefrompng($file) ;
break;
}
imagecopyresampled($tn, $image, 0, 0, 0, 0, $modwidth, $modheight, $width, $height) ;
imagejpeg($tn, $save, 100) ;
return;
}
/* END OF RESIZE FUNCTION */

//This is the directory where images will be saved
$target = "/home/users/web/b109/ipg.removalspacecom/images/COMPANIES/";
$target = $target . basename( $_FILES['upload']['name']);
 
 // Connects to your Database
// session_start();
// include ('db.php');

//This gets all the other information from the form
/* ============================================== */
/* ============================================== */
/* YOU NEED TO DO SOME VALIDATION AND SANITIZING OF YOUR FORM DATA */


if((!isset($_POST['company_name'])) || (strlen(trim($_POST['company_name'])) <5) || (trim($_POST['company_name']) !=
preg_replace("/[^a-zA-Z0-9\s\-\'\,\.\_]/", "",
trim($_POST['company_name'])))) {
/* if username is bad start building the error message */
$error_message .= "You must enter a valid company name<br>";
$error_message .= "Valid names  are min 5 characters and use letters, numbers and underscores only.<br>";
$error_message .="Your invalid company name was: <font color=\"red\">" . $_POST['company_name'] . "</font><hr>";
}
/* END validating company_name */
/* =============================================== */

if((!isset($_POST['contact_name'])) || (strlen(trim($_POST['contact_name'])) <5) || (trim($_POST['contact_name']) !=
preg_replace("/[^a-zA-Z0-9\s\-\'\,\.\_]/", "",
trim($_POST['contact_name'])))) {
/* if username is bad start building the error message */
$error_message .= "You must enter a valid contact name<br>";
$error_message .= "Valid names are min 5 characters and use letters, numbers and underscores only.<br>";
$error_message .= "Your invalid contact name was: <font color=\"red\">" . $_POST['contact_name'] . "</font><hr>";
}
/* END validating contact_name */
/* =============================================== */

 

if((!isset($_POST['phone'])) || (strlen(trim($_POST['phone'])) <5) || (trim($_POST['phone']) != preg_replace("/[^0-9\s\-\_]/", "", trim($_POST['phone'])))) {
/* if it is NOT set, then set the error variable and start building the error message */
$error_message .= "You must enter a valid phone<br>";
$error_message .= "Valid phones are min 5 characters and use letters, numbers and underscores only.<br>";
$error_message .= "Your invalid phone was: <font color=\"red\">" . $_POST['phone'] . "</font><hr>";
}else{
$phone = trim($_POST['phone']);
}

/* END validating phone */
/* =============================================== */

/* =============================================== */
/* validating the email */
/* create a function */
function validateEmailAddress($email) {
return filter_var($email, FILTER_VALIDATE_EMAIL) && preg_match('/@.+\./', $email);
}
if(!isset($_POST['email']) || validateEmailAddress($_POST['email']) !=1) {
$error_message .= "You must enter a valid email address<br>";
$error_message .= "The invalid email was: <font color=\"red\">" . $_POST['email'] . "</font><hr>";
}
/* END validating email */
/* =============================================== */

if((!isset($_POST['street1'])) || (strlen(trim($_POST['street1'])) <5) || (trim($_POST['street1']) !=
preg_replace("/[^a-zA-Z0-9\s\-\'\,\.\_]/", "",
trim($_POST['street1'])))) {
/* if username is bad start building the error message */
$error_message .= "You must enter a valid address<br>";
$error_message .= "Your invalid name was: <font color=\"red\">" . $_POST['street1'] . "</font><hr>";
}
/* END validating street1 */
/* =============================================== */
/*
if((!isset($_POST['street2'])) || (strlen(trim($_POST['street2'])) <5) || (trim($_POST['street2']) !=
preg_replace("/[^a-zA-Z0-9\s\-\'\,\.\_]/", "",
trim($_POST['street2'])))) {
*/
/* if username is bad start building the error message */
/*
$error_message = "You must enter a valid address<br>";
$error_message = $error_message . 'Your invalid name was: <font color="red">' . $_POST['street2'] . "</font><hr>";
}
*/
/* END validating street2 */
/* =============================================== */

if((!isset($_POST['premiumuser_description'])) || (strlen(trim($_POST['premiumuser_description'])) <5) || (trim($_POST['premiumuser_description']) !=
preg_replace("/[^a-zA-Z0-9\s\-\'\,\.\_]/", "",
trim($_POST['premiumuser_description'])))) {
/* if username is bad start building the error message */
$error_message .= "You must enter a Please add a Company Description<br>";
$error_message .= "Your invalid Please add a Company Description was: <font color=\"red\">" . $_POST['premiumuser_description'] . "</font><hr>";
}
/* END validating premiumuser_description */
/* =============================================== *


/* =============================================== */
/*
this section of code will set up an error message for the
username if ANY of the conditions occur
1) checks to see if $_POST['username'] is NOT set
2) if length of username is less than 5
3) if username has anything other than letter, numbers or underscores
*/
if((!isset($_POST['username'])) || (strlen(trim($_POST['username'])) <5) || (trim($_POST['username']) != preg_replace("/[^a-zA-Z0-9\_]/", "", trim($_POST['username'])))) {
/* if username is bad start building the error message */
$error_message .= "You must enter a valid username<br>";
$error_message .= "Valid usernames are min 5 characters and use letters, numbers and underscores only.<br>";
$error_message .= "Your invalid name was: <font color=\"red\">" . $_POST['username'] . "</font><hr>";
}
/* END validating username */
/* =============================================== */


/* =============================================== */
/*
this section of code will set up an error message for the
password if ANY of the conditions occur
1) checks to see if $_POST['upassword'] is NOT set
2) if length of upassword is less than 5
3) if upassword has anything other than letter, numbers or underscores
*/
if((!isset($_POST['password'])) || (strlen(trim($_POST['password'])) <5) || (trim($_POST['password']) != preg_replace("/[^a-zA-Z0-9\_]/", "", trim($_POST['password'])))) {
/* if it is NOT set, then set the error variable and start building the error message */
$error_message .= "You must enter a valid password<br>";
$error_message .= "Valid passwords are min 5 characters and use letters, numbers and underscores only.<br>";
$error_message .= "Your invalid password was: <font color=\"red\">" . $_POST['password'] . "</font><hr>";
}else{
$password = trim($_POST['password']);
}
/* END validating password */
/* =============================================== */

/* =============================================== */
/* check to see if username is already taken */
$username = mysql_real_escape_string(trim($_POST['username']));

$query1 = "SELECT username from companies WHERE username = '$username'";
$result1 = mysql_query($query1)  or die(mysql_error());
$count = mysql_num_rows($result1);
if($count>0) {
$error_message .= "The username: <font color=\"red\">" . $_POST['username'] . "</font> is taken.<hr>";
}

/* =============================================== */
/* if any of the post variables are invalid */
/* set the session variable and send back to the form page */
/*
NOT USED IN THIS EXAMPLE
if(strlen(trim($error_message))>0) {
$_SESSION['error_message'] =$error_message;
// header("Location: register00.php");
// exit();
}
*/
/* =============================================== */

$uploadDir = 'images/COMPANIES'; /* main picture folder */
$max_height = 450; /* largest height you allowed; 0 means any */
$max_width = 450; /*  largest width you allowed; 0 means any */
$max_file = 2000000;  /*  set the max file size in bytes */
$image_overwrite = 1; /* 0 means overwite; 1 means new name */
/* add or delete allowed image types */
$allowed_type01 = array( "image/gif", "image/pjpeg", "image/jpeg", "image/png", "image/x-png", "image/jpg");
$do_thumb = 1; /*  1 make thumbnails; 0 means do NOT make */
$thumbDir = "/images/thumbs";  /*  thumbnail folder */
$thumb_prefix = "";  /*  prefix for thumbnails */
$thumb_width = 90; /*  max thumb width */
$thumb_height = 70; // max thumb height
 
 //Writes the photo to the server
if(move_uploaded_file($_FILES['upload']['tmp_name'], $target)) {
/* HERE IS WHERE WE WILL DO THE ACTUAL RESIZING */
/* ============================================== */
/* ============================================== */
/* THESE SIX PARAMETERS MAY BE CHANGED TO SUIT YOUR NEEDS */
$upload = $_FILES['upload']['name'];
$o_path ="images/COMPANIES/";
$s_path = "images/thumbs/";
$file = $upload;
$save = $file;
$t_w = 200;
$t_h = 150;
/* ============================================== */
/* ============================================== */
/* DO NOT CHANGE THIS NEXT LINE */
Resize_Image($save,$file,$t_w,$t_h,$s_path,$o_path);

//Tells you if its all ok
/* ============================================== */
/* ============================================== */
/* PROVIDE A WAY FOR THEM TO GO SOMWHERE */
$error_message .= "The file ". $file . " has been uploaded, and your information has been added to the directory";

}else {
//Gives and error if its not
/* ============================================== */
/* ============================================== */
/* PROVIDE A WAY FOR THEM TO GO SOMWHERE */
$error_message .= "Sorry, there was a problem uploading your file.";
}


/* =============================================== */
/* PREPARE DATA FOR INSERTION INTO TABLE */
/* FUNCTION TO CREATE SALT */
function createSalt() {
$string = md5(uniqid(rand(), true));
return substr($string, 0, 3);
}
 
 
 //Writes the information to the database
/* ============================================== */
/* ============================================== */
/*
ALWAYS WRITE YOUR QUERIES AS STRINGS
THAT WAY WHEN TESTING, YOU CAN MAKE
SURE THAT THE VALUES CONTAIN WHAT YOU EXPECT
*/

if(empty($error_message)){ 
$salt = createsalt();
$password = trim($_POST['password']);
$hash = hash('sha256', $salt, $password);
$approved = 0;

$company_name = mysql_real_escape_string(trim($_POST['company_name']));
$contact_name = mysql_real_escape_string(trim($_POST['contact_name']));
$location = mysql_real_escape_string(trim($_POST['location']));
$postcode = mysql_real_escape_string(trim($_POST['postcode']));
$street1 = mysql_real_escape_string(trim($_POST['street1']));
$street2 = mysql_real_escape_string(trim($_POST['street2']));
$city = mysql_real_escape_string(trim($_POST['city']));
$phone = mysql_real_escape_string(trim($_POST['phone']));
$email = mysql_real_escape_string(trim($_POST['email']));
$premiumuser_description = mysql_real_escape_string(trim($_POST['premiumuser_description']));
$salt = mysql_real_escape_string($salt);
$upload = mysql_real_escape_string($upload);
$query ="INSERT INTO `companies` (company_name, contact_name, location, postcode, street1, street2, city, phone, email, premiumuser_description, password, salt, approved, upload) VALUES ('$company_name', '$contact_name', '$location', '$postcode', '$street1', '$street2', '$city', '$phone', '$email', '$premiumuser_description', '$password', '$salt', '$approved', '$upload')";
$result = mysql_query($query) or die(mysql_error());
/* =============================================== */

/*
at this point we can send an email to the admin as well
as the user.
DO NOT send the user's password to ANYONE!!!!
*/

}//if(empty($error_message))
}//if (isset($_POST['submit']))
?>

<html>
<body>
<?php
if (!empty($error_message)){ echo $error_message; }
?>
<form enctype="multipart/form-data" method="post" action="register00.php">
<table width="316" border="0">
<tr><td colspan=2><h1>Register/Sign Up</h1></td></tr>
<tr><td>Company Name:</td><td>
<input name="company_name" type="text" id="company_name" value="<?php
if (isset($_POST['company_name'])){ echo $_POST['company_name']; } ?>" />
</td></tr>
<tr><td>Contact Name:</td><td>
<input name="contact_name" type="text" id="contact_name" value="<?php
if (isset($_POST['contact_name'])){ echo $_POST['contact_name']; } ?>" />
</td></tr>
<tr><td>Contact Number:</td><td>
<input name="phone" type="number" id="phone" value="<?php
if (isset($_POST['phone'])){ echo $_POST['phone']; }else{ echo "incl. area code";} ?>" />
</td></tr>
<tr><td>Address line 1:</td><td>
<input name="street1" type="text" id="street1" value="<?php
if (isset($_POST['street1'])){ echo $_POST['street1']; } ?>" />
</td></tr>
<tr><td>Address line 2:</td><td>
<input name="street2" type="text" id="street2" value="<?php
if (isset($_POST['street2'])){ echo $_POST['street2']; } ?>" />
</td></tr>
<tr><td>Area:</td><td>
<input name="location" type="text" id="location" value="<?php
if (isset($_POST['location'])){ echo $_POST['location']; } ?>" />
</td></tr>
<tr><td>City:</td><td>
<input name="city" type="text" id="city" value="<?php
if (isset($_POST['city'])){ echo $_POST['city']; } ?>" />
</td></tr>
<tr><td>Postcode:</td><td>
<input name="postcode" type="text" id="postcode" value="<?php
if (isset($_POST['postcode'])){ echo $_POST['postcode']; } ?>" />
</td></tr>
<tr><td>Username:</td><td>
<input name="username" type="text" id="username" value="<?php
if (isset($_POST['username'])){ echo $_POST['username']; } ?>" />
</td></tr>
<tr><td>Password:</td><td>
<input name="password" type="password" class="style7" id="password" value="<?php
if (isset($_POST['password'])){ echo $_POST['password']; } ?>" />
</td></tr>
<tr><td>Email:</td><td>
<input name="email" type="text" class="style7" id="email" value="<?php
if (isset($_POST['email'])){ echo $_POST['email']; } ?>" />
</td></tr>
<tr><td>Company Logo:</td><td>
<input name="upload" type="file" class="style7" id="upload">
</td></tr>
<tr><td>Company Description:</td><td>
<textarea rows="20" cols="50" name="premiumuser_description" id="premiumuser_description"><?php
if (isset($_POST['premiumuser_description'])){ echo "{$_POST['premiumuser_description']}"; } ?></textarea>
</td></tr>
<tr><td>
<input name="Submit" type="submit" value="Register" />
</td></tr>
</table>
</form>
</body>
</html>

Just a note to say that the image DOES upload to the folder(s) /COMPANIES and /thumbs but DOES NOT show up on display of the table? all other information isnt inserted/uploaded...

I am in the process of making a promising company that is the first of it's kind in it's respective market and require an in-house programmer. PM me for further details.    Mr. Lankee

Help wanted with tweaking PHP script