PHP - Php Function To Escape Necessary Characters

Hi,
This escape function will only block quotes

How would you stop java script insertion?
 

function escape($string) {
    return htmlentities($string, ENT_QUOTES, 'UTF-8');
}

Thanks  

i have made function of prepare or check the mysql real escapte string but when i run this code it gives two warnings msg
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'SYSTEM'@'localhost' (using password: NO) in C:\wamp\www\cart\include\db.php on line 42

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in C:\wamp\www\cart\include\db.php on line 42
 kindly tell me what is this msg about how to solve it my code is
37 public function mysql_prep($value){
38 $magic_quotes_active=get_magic_quotes_gpc();
39v$new_enough_php=function_exists("mysql_real_escape_string");
40 if($new_enough_php){
   41if($magic_quotes_active){ $value=stripslashes($value);}
   42 $value= mysql_real_escape_string($value);}
   43 else {
   44   if($magic_quotes_active){$value=addslashes($value);}
      
   45}
   46   return $value;
      
48 }

I have sen this function before but can not remember what it is or how to code it. It allows you remove only defined characters from the end of the string. I am not looking to replace any occurrence anywhere in the phrase, just the end.

For example lets say I want to remove"ld!" from phrase "Hello World!" That function would return "Hello Wor"

Thanks

This topic has been moved to PHP Regex.

http://www.phpfreaks.com/forums/index.php?topic=322184.0

Hey!
Code: [Select]
echo "<ol type=\"a"\>";This gives an error, how am I supposed to escape the " " correctly?

Hi guys, I think escaping is the correct term, apologies if its not.

Could anyone show me how I  can escape this so it works? Thanks

Code: [Select]
echo "[ - <a href="/$dir/game_play.php">Play</a> - ]";

Hello, I was wondering if I need to escape all get values.  I often use a $_GET variable as in mypage.php?id=variable to selecting records to view etc.  I usually convert this to a variable to be used in a WHERE statement.
Code: [Select]
IF ($_GET['id']){
$id=$_GET['id'];
}
But what if someone tried to view all records
Quote

http://www.mypage.com/page.php?id=0';SELECT%20*%20FROM%20CONTENT;'SELECT%20*%20FROM%20CONTENT%20WHERE%20ID='0


resulted in all content page data being displayed somehow. Or better yet, if visiting
Quote

http://www.mypage.com/page.php?id=0';DELETE%20*%20FROM%20CONTENT;'SELECT%20*%20FROM%20CONTENT%20WHERE%20ID='0


resulted in all content being deleted. 

Is that even possible in the in the context of a MySQL WHERE statement?  Seems like the MySQL statement wouldn't be structured correctly and wouldn't work.
I use mysqli_real_escape_string" on posted content but should I also escape all GET input?

I have front page and page for news, and i wonna to set, on front page to show news but only 100 characters, and on news page to be all text, i done that with substr($news, 0, 100); but i have proble, when i have in $news text like this:
Code: [Select]
Hi everyone.
<b>Bold</b>now, subsrt count <b> and </b> like characters, how can i escape that <b> </b>, <u> </u> and other?

I haven't coded HTML or PHP in several years and am trying to get back into it.

Seems to me that there were some nifty tricks so that when you were conctenating HTML and PHP you didn't get a birds nest.

Maybe it was using something like { } but I don;t recall.

I also seem to recall that wisely choosing where to use single (') and double (") quote was key!

For example, how could this code be cleaner?

	echo '<table id="membershipPlans">
	<!-- Column Groups -->
	<colgroup>
	  <col id="feature">'."\r";
	  foreach ($plan_names as $p_id => $p_name):
	    echo '<col id="option0'.$p_id.'">'."\r";
	  endforeach;
	  echo '</colgroup>";
	

 

Hi Chaps, this is really getting my back up as its never happened before...im doing a site on a server im not familiar with and its causing me problems

Code: [Select]
<?
if(isset($_POST['upload']))
{
        include 'dbconnection.php';
$ttitle = mysql_real_escape_string($_POST['ttitle']);
$ttitle2 = mysql_real_escape_string($_POST['ttitle2']);
$query = "INSERT INTO test ( ttitle, ttitle2) ".
             "VALUES ('$ttitle', '$ttitle2' )";
             mysql_query($query) or die('Error, query failed : ' . mysql_error());                   
echo "<br>File uploaded<br>";
}       
?>
The database table is showing that it includes the backslash in the record, whereas i understood mysql_real_escape_string was oinly used to carry the data, and the backslash wouldn't be uncluded.

From the server:
PHP.ini file: (ver 5.2.17)
magic_quotes_gpc Off Off
magic_quotes_runtime Off Off
magic_quotes_sybase Off Off

Is there something i can do to get this sorted, as i dont want to add stripslashes() throught the site.

As with the above, i have some forms with loads of fields, so if there is someway of adding a function that would be great....

thanks in advance

Hello I am having a problem trying to write to a database using mysql real escape so there wont be any injection attacks. I trying using myrealescape and it returns errors:
Code: [Select]
Notice: Use of undefined constant messageTo - assumed 'messageTo' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageSubject - assumed 'messageSubject' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageBody - assumed 'messageBody' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17
I add in the single quotes and it doesn't write either. Dreamweaver says that either single quotes or not there is no syntax errors.

What going on? I have used it like this befo ('$ID','" . mysql_real_escape_string($_POST[post_content]) . "') and no problems..

~AJ


<?php 
require_once('connect.php');

if(isset($_COOKIE['user'])){}else{
header( 'Location: members.php');
}

if (isset($_POST['sendBtn'])){

$messageFrom = $_COOKIE['user'];
$messageTo = $_POST['messageTo'];
$hash = $messageTo.$messageFrom.time();
$hash = md5($hash);

mysql_select_db("majik");

$sql="INSERT INTO messagesystem(ID, hash, messageTo, messageFrom, messageSubject, messageBody, messageDate, messageRead, messageDelete) VALUES ('','$hash','" . mysql_real_escape_string($_POST['messageTo']) . "','$messageFrom','" . mysql_real_escape_string($_POST['messageSubject']) . "','" . mysql_real_escape_string($_POST['messageBody']) . "','0','0')";

echo '<center>Your message was sent to: '.$messageTo.'</center>';


}


?>

My hosts version of php just seems to automatically add the backslashes.
Adding the escape string just seems to add like 3 of them rather than 1

Is this command out-of-date?

Hi,

when i submit the form using the following text...

-1 OR 1=1) AND 1=(SELECT IF((IFNULL(ASCII(SUBSTRING((SELECT @@VERSION),1,1)),0)>25),1,2))

that was sent by the hacker in my website

i am trying to escape the above and filter it ...


am using the mysql_Real_escape_string and trim function..

but nothing escaped...

can u give me a suggestion , pls help me

Hi, I have a site where users can register etc. I was wondering should I use mysql_real_escape_string() for the elements on my registration form example email, name and so on or is it no necessary?
One more question could some one tell is this the proper way to use it before inserting into the database.

$name=$_POST['name'];

mysql_real_escape_string($name)

?