|
PHP - Htmlspecialchars Vs Mysqli_real_escape_string
which one is necessary while protecting form field Edited July 28, 2019 by mahendaSimilar TutorialsI am updating all my code from mysql to mysqli. Currently using PHP 5.4 but will update to 5.5 once all this updating is done.
Anyway, I have this old function for making data safe for inserting into mysql database. I changed all instances of "mysql" to "mysqli"...
function mysqli_prep($value) {
$magic_quotes_active = get_magic_quotes_gpc();
$new_enough_php = function_exists("mysqli_real_escape_string") ; //i.e. PHP >= v4.3.0
if($new_enough_php) { //PHP v4.3.0 or higher
//undo any magic quote effects so mysqli_real_escape_string can do the work
if($magic_quotes_active) { $value = stripslashes($value) ;}
$value = mysqli_real_escape_string($connection, $value);
} else { //before php v4.3.0
// if magic quotes aren;t already on then add slashes manually
if(!magic_quotes_active) { $value = addslashes($value); }
// if magic quotes are active, then the slashes already exist
}
return $value;
}
When I load that page that calls this function, I get...
Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, null given in (mypath)This is my $connection by the way, which works fine on other pages that need it...
$connection = mysqli_connect('localhost', 'myusername', 'mypassword', 'mytable');
if (!$connection) {
die("database connection failed: " . mysqli_error());
}
Any ideas what I'm doing wrong?
This works: $name = mysqli_real_escape_string(mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME), trim($_POST['name'])); This DOESN'T work: $name = mysqli_real_escape_string($dbc, trim($_POST['name'])); // Connect to the database $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME); With the second version I get the error message "expects parameter 1 to be mysqli". But parameter 1 IS mysqli, as you can see under $dbc. So what's the deal? PDO-Prepared Statements using mysqli_real_escape_string
Is it a good Idea to use mysqli_real_escape_string for extra security In the Prepared Statements
<?php
try {
require_once '../includes/pdo_connect.php';
$make = mysqli_real_escape_string($_GET['make']);
$sql = 'SELECT *
FROM cars
WHERE make LIKE :make AND yearmade >= :yearmade AND price <= :price
ORDER BY price';
$stmt = $db->prepare($sql);
$stmt->bindValue(':make', '%' . $make . '%');
$stmt->bindParam(':yearmade', $_GET['yearmade'], PDO::PARAM_INT);
$stmt->bindParam(':price', $_GET['price'], PDO::PARAM_INT);
$stmt->execute();
$errorInfo = $stmt->errorInfo();
if (isset($errorInfo[2])) {
$error = $errorInfo[2];
}
} catch (Exception $e) {
$error = $e->getMessage();
}
Hi,
I need some insight on how to go about fixing some broken code due to host upgrading PHP from 5.3 to 5.4 - see error below:
Warning: mysqli_real_escape_string() expects exactly 2 parameters, 1 given in...Yes, I aware, the two parameters that are required which would be as follow - with $db being the connection string: mysqli_real_escape_string($db, $value);Right now, the $db arguement is NOT in the 'mysqli_real_escape_string() function - read below to know why (that's what i need help to fix): My problem is this function - itself - is being called within a function which (with PHP 5.3 used MYSQL extensions but PHP5.4 deprecated those functions and MYSQLi requiring 2 parameters as stated.... See that entire piece of code to see the issue which involves the 'quote_smart' function which executes the mysqli_real_escape_string() function inside 'quote_smart' function: Here's the defined function, currently:
function quote_smart($value){
// Stripslashes if magic quotes is on
if(get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
// Quote if not a number or a numeric string
if (!is_numeric($value)) {
$value = mysqli_real_escape_string($value);
}
return $value;
}
and it's being called as such:
${$key} = quote_smart($value);
Thus, my problem - I'm not sure how to pass the mysqli link (arguement) into the function - correctly - or if i should just make the $db var 'global' within the quote_smart function itself - now that PHP is 5.4.
FYI: Yes, the objective is to rewrite all this code with PDO and prepared statements but need to get this up, quickly, with temp fix due to sudden issues due to host upgrade.
Would really appreciate some guidance on this one - thx!
I'm getting this error and not sure my fix. <b>Warning</b>: htmlspecialchars() expects parameter 1 to be string, array given in <b>/home/xtremer/public_html/efedmanager/processes/polls.php</b> on line <b>13</b><br /> $answer = explode(',', $_POST['answersList']); $answer = htmlspecialchars($answer); Hi, should i use htmlspecialchars() when i write in mysql or when i read from mysql, and should i use another function for safety ? Hello and thanks in advance for any help. Overview: Im tyring to pull data from a XML api using simpleXML. I have ran into a problem with special characters and entities that simpleXML does not accept. IE " " Ive tried all the solutions i could find to no avail. SimpleXML gives me this error. parser error : Entity 'nbsp' not defined in Here is my code. Code: [Select] $feed = simplexml_load_file('URL TO API FEED'); $feed = html_entity_decode($feed); $feed = str_ireplace(array('<','>','&','\'','"'),array('<','>','&',''','"'),$feed); echo 'Game Title: ' .$feed->game. '</br>'; echo 'Ponts Earned: ' .$feed->gamerscore. '</br>'; echo 'Total Achievements: ' .$feed->totalachievements. '</br>'; foreach($feed->achievements->achievement as $ach) { $output = htmlentities($feed->title, ENT_QUOTES, "UTF-8"); echo $output; if( !empty($ach->unlockedartwork)){ echo '<img src=' .$ach->unlockedartwork. '></img></br>'; }else { echo '<img src=' .$ach->artwork. '></img></br>'; } } Here is the code im trying to retrieve. Code: [Select] <achievement id="40"> <title>Have Gun Will Travel </title> <artwork>http://</artwork> <gamerscore>20</gamerscore> <unlocked>true</unlocked> <unlockdate>7/4/2010</unlockdate> </achievement> What do most people prefer to use? htmlspecialchars or htmlentities I need to put this inside of a p tag so I can change some properties but everything I've tried doesn't work and just shows nothing.
I've tried this:
printf('<p style="text-align: left; width: 500px;">', htmlspecialchars($fetch['shout'], ENT_QUOTES, 'UTF-8'), '</p>');
This is what I need to be wrapped in p tags:
htmlspecialchars($fetch['shout'], ENT_QUOTES, 'UTF-8');EDIT: I've noticed the code below works but when I style it inside of the tag the text won't show, should I include a CSS file on the PHP file? echo "<p>".htmlspecialchars($fetch['shout'])."</p>\n";EDIT: I just needed to create the CSS for the p tags in the index and it worked perfectly fine. Sorry for the pointless thread. Edited by Alanay, 18 December 2014 - 09:14 AM. Not sure how to debug this. I have the following error that is ONLY happening when our site has a PCI scan running : -
ERRNO: 2
TEXT: htmlspecialchars() expects parameter 1 to be string, array given
LOCATION: /home/bttorj45/public_html/smarty_templates_c/dbbe565f1731d4158472b66b75c85442498e81b9_0.file.top_menu_bar.tpl.php, line 42, at April 11, 2020, 5:05 pm
Showing backtrace:
htmlspecialchars(Array[1], "3", "UTF-8", true) # line 42, file: /home/siteaddress/public_html/smarty_templates_c/dbbe565f1731d4158472b66b75c85442498e81b9_0.file.top_menu_bar.tpl.php
content_5e83087341d089_14126332(Object:Smarty_Internal_Template) # line 123, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_template_resource_base.php
Smarty_Template_Resource_Base.getRenderedTemplateCode(Object:Smarty_Internal_Template) # line 114, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_template_compiled.php
Smarty_Template_Compiled.render(Object:Smarty_Internal_Template) # line 216, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_template.php
Smarty_Internal_Template.render() # line 385, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_template.php
Smarty_Internal_Template._subTemplateRender("file:page_elements/top_menu_bar.tpl", null, null, "0", "120", Array[0], "0", false) # line 56, file: /home/siteaddress/public_html/smarty_templates_c/0e4c1495f7a25cef1d85553f951690964f702a5a_0.file.error404.tpl.php
content_5e4ffba4a49c66_36622821(Object:Smarty_Internal_Template) # line 123, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_template_resource_base.php
Smarty_Template_Resource_Base.getRenderedTemplateCode(Object:Smarty_Internal_Template) # line 114, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_template_compiled.php
Smarty_Template_Compiled.render(Object:Smarty_Internal_Template) # line 216, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_template.php
Smarty_Internal_Template.render(false, "1") # line 232, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_templatebase.php
Smarty_Internal_TemplateBase._execute(Object:Smarty_Internal_Template, null, null, null, "1") # line 134, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_templatebase.php
Smarty_Internal_TemplateBase.display("pages/error404.tpl") # line 65, file: /home/siteaddress/public_html/errors/404.php
include("/home/siteaddress/public_html/errors/404.php") # line 34, file: /home/siteaddress/public_html/smarty_plugins/function.load_product.php
Product.init("api") # line 5, file: /home/siteaddress/public_html/smarty_plugins/function.load_product.php
smarty_function_load_product(Array[2], Object:Smarty_Internal_Template) # line 39, file: /home/siteaddress/public_html/smarty_templates_c/53725e8a2fc4b6c7c0c42e801dab2741a0994a8e_0.file.product.tpl.php
content_5e579e9761f086_59385269(Object:Smarty_Internal_Template) # line 123, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_template_resource_base.php
Smarty_Template_Resource_Base.getRenderedTemplateCode(Object:Smarty_Internal_Template) # line 114, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_template_compiled.php
Smarty_Template_Compiled.render(Object:Smarty_Internal_Template) # line 216, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_template.php
Smarty_Internal_Template.render(false, "1") # line 232, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_templatebase.php
Smarty_Internal_TemplateBase._execute(Object:Smarty_Internal_Template, null, null, null, "1") # line 134, file: /home/siteaddress/public_html/include/smarty/sysplugins/smarty_internal_templatebase.php
Smarty_Internal_TemplateBase.display("pages/product.tpl") # line 85, file: /home/siteaddress/public_html/dirs.php
I ***think*** the scan must be inputting something in the search box to cause this (I'm awaiting info from Security Metrics with regard to this).
{load_chat assign="chat"}
{if $chat->mChat}
<script type="text/javascript" id="763333b0f312f025d780a8f4451bf6f3" src="https://www.siteaddress.com/online-support/script.php?id=763333b0f312f025d780a8f4451bf6f3"></script>
{/if}
{if !$chat->mChat && $settings->mSettings[13]}
<script type="text/javascript" id="aaa07817d7cd2a7dce9e0ffac6286dbb" src="https://www.siteaddress.com/online-support/script.php?id=aaa07817d7cd2a7dce9e0ffac6286dbb"></script>
{/if}
<div id="menu_switch"><i class="fa fa-bars fa toggler"></i></div>
<form id="product_search" method="get" action="{$smarty.const.SITE_ROOT}/searchresults/">
<input type="text" name="search" placeholder=" Product Search" style="font-family: FontAwesome, Arial; font-style: normal; font-size:18px;" {if isset($smarty.request.search) && $settings->mSettings[107]}value="{$smarty.request.search|escape:'htmlall'}"{/if} /><button type="submit" class="button"><i class="fa fa-search" aria-hidden="true"></i> <i class="fa fa-caret-right" aria-hidden="true"></i></button>
</form>
<form id="code_search" method="post" action="{$smarty.const.SITE_ROOT}/cart/quickadd.php">
<input type="text" name="code" maxlength="14" placeholder=" Product Code" style="font-family: FontAwesome, Arial; font-style: normal; font-size:18px;" /><button type="submit" name="submit" class="orange"><i class="fa fa-shopping-cart" aria-hidden="true"></i> Quick Add <i class="fa fa-caret-right" aria-hidden="true"></i></button>
</form>
{if !isset($hidecart) && isset($cartsmall) && $cartsmall->mCart.sub > 0}
<p id="view_cart"><a class="button orange" href="{$smarty.const.SITE_ROOT}/cart/"><span class="hidden-xs hidden-sm"><i class="fa fa-shopping-cart" aria-hidden="true"></i> View Cart </span>£{$cartsmall->mCart.sub} <i class="fa fa-caret-right" aria-hidden="true"></i></a></p>
{/if}
<script>
$('.toggler').click(function() {
$(this).toggleClass("fa-bars fa-times");
});
</script>
function.load_search.php :-
<?php
function smarty_function_load_search($params, $smarty) {
$search = new Search();
$search->init();
$smarty->assign($params['assign'], $search);
}
class Search {
// public fields
public $mSearchString;
public $mSearchArray;
public $mProducts;
public $mProductCount;
// private fields
private $mDoSettings;
private $mDoCatalogue;
function __construct() {
require_once FILE_ROOT . '/data_objects/do_settings.php';
$this->mDoSettings = new DoSettings();
require_once FILE_ROOT . '/data_objects/do_catalogue.php';
$this->mDoCatalogue = new DoCatalogue();
if (isset($_REQUEST['search']) && strlen(trim($_REQUEST['search']))>0 ) {
$this->mSearchString = trim(stripslashes($_REQUEST['search']));
$this->mSearchArray = explode(" ", $this->mSearchString);
} else {
header ("Location: /emptysearch/");
die ();
}
}
public function init() {
$this->mProducts = $this->mDoCatalogue->SearchProducts($this->mSearchArray);
$this->mProductCount = count($this->mProducts);
for ($i = 0; $i < count($this->mProducts); $i++) {
$this->mProducts[$i]['price_inc'] = number_format($this->mProducts[$i]['price'] * (($this->mDoSettings->GetSetting(1) / 100) + 1), 2, ".", ",");
}
}
}
?>
do_catalogue.php :-
public function SearchProducts($search) {
$fields = array("code", "title", "keywords");
$query_string = "SELECT p.code, p.title, p.cattext, p.price, p.img, p.url, p.available, p.due, p.special, p.newproduct, p.discontinued, c.name, c.menulinktext FROM " . $this->mProductTable . " p " .
"JOIN categories c ON p.category = c.id " .
"WHERE ((";
for ($f = 0; $f < count($fields); $f++) {
if ($f != 0) { $query_string .= ") OR ("; }
for ($s = 0; $s < count($search); $s++) {
if ($s != 0) { $query_string .= " AND "; }
$query_string .= "p." . $fields[$f] . " LIKE '%" . $this->mDoQuery->dbManager->DbEscape($search[$s]) . "%'";
}
}
$query_string .= ")) AND active=1 AND live=1 " .
"ORDER BY p.rating ASC";
return $this->mDoQuery->dbManager->DbGetAll($query_string);
}
Any idea's how to fix it? I can't replicate it with a specific issue as I don't know what the scan is doing to cause this! Thanks Hello Guys ... i am new here and i am also new in php i selfstudy html css and js and bootstrap for front-end and for back-back php & mysql & PDO & OOP and i will soon start mvc then laravel and i am trying to secure my input field and i do not want any attacks or sql injects and i see people user filter_var and htmlentities and htmlspecialchars and each one has diffrent opinion can some one help me and tell me what is the best for securing input which all values will store in database thanks <3
When sending data via $_POST for example, I've seen the data get filtered with both mysql_real_escape_string or htmlspecialchars When should you use one or the other? HI all, Please advice me 1. When to use htmlspecialchars() or mysql_real_escape_string? 2. what is the diffrent? Thank you for your help. Does anyone have an example of when htmlentities() would be used over htmlspecialchars()? Hello dears, I've tried to use htmlspecialchars or htmlentities but both no longer work ! Example1 : Code: [Select] <?php $new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES); echo $new; ?> Output should <a href='test'>Test</a> Code: [Select] <?php $str = "A 'quote' is <b>bold</b>"; echo htmlentities($str); ?> Output should A 'quote' is <b>bold</b> But it isn't working ? what is wrong ? htmlspecialchars($str, ENT_QUOTES, 'UTF-8');Using this code with UTF-8. I need someone to help craft up some smalll xss injections with this. I heard htmlspecialchars doesn't stop all xss attacks, so I'm wondering what's the most xss attack you can craft to load a simple cookie loader. (Basically, just simple javascript injection is all I'm trying to find, because people can use cookie loaders with it, and yeah, that's not good). Looking for your code to be posted, and once it is.. I'll copy it and submit it through the code I posted above and see if there is any vulnerabilities. (On my localhost server) Thanks! $str = user input. Oh, and here is the BBCODE regex that the code passes through before this function is returned on the text. $text = preg_replace( "#\[b\](.+?)\[/b\]#is", "<span class='b'>\\1</span>", $text );
$text = preg_replace( "#\[i\](.+?)\[/i\]#is", "<i>\\1</i>", $text );
$text = preg_replace( "#\[u\](.+?)\[/u\]#is", "<u>\\1</u>", $text );
$text = preg_replace( "#\[s\](.+?)\[/s\]#is", "<s>\\1</s>", $text );
//Spoiler
$text = preg_replace( "#\[right\](.+?)\[/right\]#is", "<div style='text-align:right'>$1</div>", $text );
//Beautiful Colors
$text = preg_replace( "%\[colou?r=([a-zA-Z]{3,20}|\#[0-9a-fA-F]{6}|\#[0-9a-fA-F]{3})](.+?)\[/colou?r\]%msi", '<span style="color: \\1">\\2</span>', $text );
$text = preg_replace( "%\[colou?r=(rgb\(\d{1,3}, ?\d{1,3}, ?\d{1,3}\))](.+?)\[/colou?r\]%msi", '<span style="color: \\1">\\2</span>', $text );
If anyone can craft up an XSS for this, I'd appreciate it. Because I need this to be secure.
Edited by Monkuar, 10 January 2015 - 06:33 PM. htmlspecialchars($str, ENT_QUOTES, 'UTF-8');Using this code with UTF-8. I need someone to help craft up some smalll xss injections with this. I heard htmlspecialchars doesn't stop all xss attacks, so I'm wondering what's the most xss attack you can craft to load a simple cookie loader. (Basically, just simple javascript injection is all I'm trying to find, because people can use cookie loaders with it, and yeah, that's not good). Looking for your code to be posted, and once it is.. I'll copy it and submit it through the code I posted above and see if there is any vulnerabilities. (On my localhost server) Thanks! $str = user input. Oh, and here is the BBCODE regex that the code passes through before this function is returned on the text. $text = preg_replace( "#\[b\](.+?)\[/b\]#is", "<span class='b'>\\1</span>", $text );
$text = preg_replace( "#\[i\](.+?)\[/i\]#is", "<i>\\1</i>", $text );
$text = preg_replace( "#\[u\](.+?)\[/u\]#is", "<u>\\1</u>", $text );
$text = preg_replace( "#\[s\](.+?)\[/s\]#is", "<s>\\1</s>", $text );
//Spoiler
$text = preg_replace( "#\[right\](.+?)\[/right\]#is", "<div style='text-align:right'>$1</div>", $text );
//Beautiful Colors
$text = preg_replace( "%\[colou?r=([a-zA-Z]{3,20}|\#[0-9a-fA-F]{6}|\#[0-9a-fA-F]{3})](.+?)\[/colou?r\]%msi", '<span style="color: \\1">\\2</span>', $text );
$text = preg_replace( "%\[colou?r=(rgb\(\d{1,3}, ?\d{1,3}, ?\d{1,3}\))](.+?)\[/colou?r\]%msi", '<span style="color: \\1">\\2</span>', $text );
If anyone can craft up an XSS for this, I'd appreciate it. Because I need this to be secure.
Edited by Monkuar, 10 January 2015 - 06:33 PM. Hello, I'm learning PHP, so a completely noob, right now. First to the question itself, I want to know how to retrieve the data(variables & it's values) from the url, which was made or generated(or whatever right word is) by using http_build_query() in php. I created a querystring($string) with certain variables & dynamic values that I'm passing to a url $asciiart_name = strip_tags(mysqli_real_escape_string($dbc, trim($_POST['asciiart_name']))); $asciiart_category = strip_tags(mysqli_real_escape_string($dbc, trim($_POST['asciiart_category']))); $asciiart_contribution = htmlspecialchars($_POST['asciiart_contribution']); $asciiart_contribution = str_replace("'","''", $asciiart_contribution); Above is my code, with a textarea you can post the data into the $asciiart_contribution variable, BUT you can not post anything including backslash, is there any way to allow this one character? I'd still like the people to not use any html code, but at the same time I want a certain freedom of characters which includes use of backslash. Thanks for all the tips. |
|||||||