PHP - Why Is This Causing Escape Characters In My Db?

Hi guys, I think escaping is the correct term, apologies if its not.

Could anyone show me how I  can escape this so it works? Thanks

Code: [Select]
echo "[ - <a href="/$dir/game_play.php">Play</a> - ]";

Hey!
Code: [Select]
echo "<ol type=\"a"\>";This gives an error, how am I supposed to escape the " " correctly?

Hi Chaps, this is really getting my back up as its never happened before...im doing a site on a server im not familiar with and its causing me problems

Code: [Select]
<?
if(isset($_POST['upload']))
{
        include 'dbconnection.php';
$ttitle = mysql_real_escape_string($_POST['ttitle']);
$ttitle2 = mysql_real_escape_string($_POST['ttitle2']);
$query = "INSERT INTO test ( ttitle, ttitle2) ".
             "VALUES ('$ttitle', '$ttitle2' )";
             mysql_query($query) or die('Error, query failed : ' . mysql_error());                   
echo "<br>File uploaded<br>";
}       
?>
The database table is showing that it includes the backslash in the record, whereas i understood mysql_real_escape_string was oinly used to carry the data, and the backslash wouldn't be uncluded.

From the server:
PHP.ini file: (ver 5.2.17)
magic_quotes_gpc Off Off
magic_quotes_runtime Off Off
magic_quotes_sybase Off Off

Is there something i can do to get this sorted, as i dont want to add stripslashes() throught the site.

As with the above, i have some forms with loads of fields, so if there is someway of adding a function that would be great....

thanks in advance

I have front page and page for news, and i wonna to set, on front page to show news but only 100 characters, and on news page to be all text, i done that with substr($news, 0, 100); but i have proble, when i have in $news text like this:
Code: [Select]
Hi everyone.
<b>Bold</b>now, subsrt count <b> and </b> like characters, how can i escape that <b> </b>, <u> </u> and other?

Hello, I was wondering if I need to escape all get values.  I often use a $_GET variable as in mypage.php?id=variable to selecting records to view etc.  I usually convert this to a variable to be used in a WHERE statement.
Code: [Select]
IF ($_GET['id']){
$id=$_GET['id'];
}
But what if someone tried to view all records
Quote

http://www.mypage.com/page.php?id=0';SELECT%20*%20FROM%20CONTENT;'SELECT%20*%20FROM%20CONTENT%20WHERE%20ID='0


resulted in all content page data being displayed somehow. Or better yet, if visiting
Quote

http://www.mypage.com/page.php?id=0';DELETE%20*%20FROM%20CONTENT;'SELECT%20*%20FROM%20CONTENT%20WHERE%20ID='0


resulted in all content being deleted. 

Is that even possible in the in the context of a MySQL WHERE statement?  Seems like the MySQL statement wouldn't be structured correctly and wouldn't work.
I use mysqli_real_escape_string" on posted content but should I also escape all GET input?

I haven't coded HTML or PHP in several years and am trying to get back into it.

Seems to me that there were some nifty tricks so that when you were conctenating HTML and PHP you didn't get a birds nest.

Maybe it was using something like { } but I don;t recall.

I also seem to recall that wisely choosing where to use single (') and double (") quote was key!

For example, how could this code be cleaner?

	echo '<table id="membershipPlans">
	<!-- Column Groups -->
	<colgroup>
	  <col id="feature">'."\r";
	  foreach ($plan_names as $p_id => $p_name):
	    echo '<col id="option0'.$p_id.'">'."\r";
	  endforeach;
	  echo '</colgroup>";
	

 

Hi, I have a site where users can register etc. I was wondering should I use mysql_real_escape_string() for the elements on my registration form example email, name and so on or is it no necessary?
One more question could some one tell is this the proper way to use it before inserting into the database.

$name=$_POST['name'];

mysql_real_escape_string($name)

?

Hi,

when i submit the form using the following text...

-1 OR 1=1) AND 1=(SELECT IF((IFNULL(ASCII(SUBSTRING((SELECT @@VERSION),1,1)),0)>25),1,2))

that was sent by the hacker in my website

i am trying to escape the above and filter it ...


am using the mysql_Real_escape_string and trim function..

but nothing escaped...

can u give me a suggestion , pls help me

Hello I am having a problem trying to write to a database using mysql real escape so there wont be any injection attacks. I trying using myrealescape and it returns errors:
Code: [Select]
Notice: Use of undefined constant messageTo - assumed 'messageTo' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageSubject - assumed 'messageSubject' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageBody - assumed 'messageBody' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17
I add in the single quotes and it doesn't write either. Dreamweaver says that either single quotes or not there is no syntax errors.

What going on? I have used it like this befo ('$ID','" . mysql_real_escape_string($_POST[post_content]) . "') and no problems..

~AJ


<?php 
require_once('connect.php');

if(isset($_COOKIE['user'])){}else{
header( 'Location: members.php');
}

if (isset($_POST['sendBtn'])){

$messageFrom = $_COOKIE['user'];
$messageTo = $_POST['messageTo'];
$hash = $messageTo.$messageFrom.time();
$hash = md5($hash);

mysql_select_db("majik");

$sql="INSERT INTO messagesystem(ID, hash, messageTo, messageFrom, messageSubject, messageBody, messageDate, messageRead, messageDelete) VALUES ('','$hash','" . mysql_real_escape_string($_POST['messageTo']) . "','$messageFrom','" . mysql_real_escape_string($_POST['messageSubject']) . "','" . mysql_real_escape_string($_POST['messageBody']) . "','0','0')";

echo '<center>Your message was sent to: '.$messageTo.'</center>';


}


?>

I'm using a PHP foreach loop to set Javascript array values from PHP array values  The problem is that some of the array values contain double quotes(") so it compromises the JS script.  Is there a PHP function that automatically escapes each double quote in a given string?

My hosts version of php just seems to automatically add the backslashes.
Adding the escape string just seems to add like 3 of them rather than 1

Is this command out-of-date?

Hi,   I'm currently passing an array of values to be updated in my database, but am struggling on the best way to escape the quotation marks around the NOW statement below, as understand this will only work without them.
  This is what is being passed to the DB which does not currently work. I'm seeking some help to find the best way to remove the "" from around the NOW statement, but retain it in the array structure which i believe needs the '' to understand its a value.

UPDATE staff SET staff_last_login="NOW()" WHERE staff_id="1" 

array('staff_last_login'=>'NOW()')

My question is - whats the best way to escape this?   I understand forward slashes can sometimes be used, and double quotes - but feel like i have exhausted all my known options.   Any help much appreciated.   MoFish

I have never used real escape string so want to make sure I did it correctly. Also, if I can place it anywhere else to make it even more secure please let me know. This is just the action of a just a simple POST html form.

Here it is.
Code: [Select]
<?php
require ('staffarea/sql.php');
$showform="false";

$mcid = mysql_real_escape_string($_POST['mcid']);       
$age = mysql_real_escape_string($_POST['age']);
$description = mysql_real_escape_string($_POST['description']);

if(!mysql_query("INSERT INTO `somedatabase`.`appsubmissions` (`id`, `username`, `age`, `description`, `status`) VALUES (NULL, '$mcid', '$age', '$description', 'Pending');"))
{
echo '<div class=blockrow><b><font size=4>Submission Error</font><br /><br />Something went wrong. Contact Staff in the Support Forums and give them this information:<br /><br /></b><font color=red>';

echo mysql_error();

echo "</font>";

echo '<br /><br /><a href="/forumdisplay.php?f=14">Support Forums</a></div>';
}
else
{

$lastID=mysql_insert_id();

echo "<div class=blockrow><font size=3><b>$mcid, Thank You for your Building Application!</b></font><br /><br />";

echo "Your Unique Application ID: <b>", $lastID;

echo "</b> (save this so you can check the application status later)<br /><br />

Your application was submitted successfully. Please allow Staff 24 hours to accept or deny your application. If after 48 hours you still do not have building rights, assume the application was denied and re-submit with different information. DO NOT submit an application more than every 48 hours, doing so will get your account banned for spamming.<br /><br />

While waiting, you might check out the <a href=/index.php?pageid=mcguide>Ultimate Guide</a>.</div>";
}

mysql_close($con);

?>

on the first column do I need to escape that? "pm_id"
if so how do i do that with the right syntax
is it like this?
pm_id = '.mysql_real_escape_string.'


Code: [Select]
<?php $mail2 = "INSERT INTO pm SET pm_id = '', sendto = '".mysql_real_escape_string($to)."', sentfrom = '".mysql_real_escape_string($from)."' ?>
Also when you create a new row with a id  having auto increment. do i have to do id ="" so there isnt ever two rows matching the same id?

I enter the following:
select nam_last from names where nam_last = 'cohn' into a form field

When I print it in the next program I get
select nam_last from names where nam_last = \'cohn\'

Which generates an error:
SELECT Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'cohn\'' at line 1

What causes the \ to be added into the field, and how do I stop it?