PHP - Best Way To Escape Php Code

Hello. My client and I are trying to figure out a strange issue with exporting blobs. We are trying to sync a WAMP based databse and local MySQL database. The problem is with blob columns.  The issue: 

When exporting a blob, the local MySQL dump command inserts an escape character "\" before characters such as NUL, TAB and LF, and I am assuming a lot more. My PHP export function (opens a file, SELECT * FROM tbl, writes to the file) does not do this. 

The main issue is that my client cannot import my PHP dump files when there are blobs, which I suppose is because they are missing these escape characters. He can however re-import his own MySQL dumps. 

I know I could remedy by using PHP string replace functions to find each character and insert a '\' before it, but I don't know which characters will need to be escaped. I also feel like there is a more simple solution. For example this is what I have and it worked for a tiny 1 pixel image, but not for something complex:

$val = str_replace(chr('NUL'), '\0', $val);							
$val = str_replace(chr(0x9), chr(0x5c).chr(0x9), $val);	
$val = str_replace(chr(0xa), chr(0x5c).chr(0xa), $val);	

Thanks

I'm using a PHP foreach loop to set Javascript array values from PHP array values  The problem is that some of the array values contain double quotes(") so it compromises the JS script.  Is there a PHP function that automatically escapes each double quote in a given string?

I am having problems understanding how to sanitize my form data so it is safe to INSERT.

If I use this code...
Quote

   $trimmed = array_map('trim', $_POST);
   $body = mysqli_real_escape_string($dbc, $trimmed['body']);


And I enter into my form...
Quote

O'Reilly's book


Then I see this in phpMyAdmin...
Quote

O\'Reilly\'s book


---------

If I use this code...
Quote

   $trimmed = array_map('trim', $_POST);
   $body = $trimmed['body'];


And I enter into my form...
Quote

O'Reilly's book


Then I see this in phpMyAdmin...
Quote

O'Reilly's book



Why the strange behavior??



Debbie

Hi,

when i submit the form using the following text...

-1 OR 1=1) AND 1=(SELECT IF((IFNULL(ASCII(SUBSTRING((SELECT @@VERSION),1,1)),0)>25),1,2))

that was sent by the hacker in my website

i am trying to escape the above and filter it ...


am using the mysql_Real_escape_string and trim function..

but nothing escaped...

can u give me a suggestion , pls help me

I've got a basic text input area within a form for users to add a brief bio about themselves. I made sure to use mysql_real_escape_string to avoid problems with special characters. However, when I want to display the content within the text area when a user chooses to update or change their bio, the text displays the escape characters.

How do I display data from my db without the user having to deal with the escape characters?

My hosts version of php just seems to automatically add the backslashes.
Adding the escape string just seems to add like 3 of them rather than 1

Is this command out-of-date?

Hi, I have a site where users can register etc. I was wondering should I use mysql_real_escape_string() for the elements on my registration form example email, name and so on or is it no necessary?
One more question could some one tell is this the proper way to use it before inserting into the database.

$name=$_POST['name'];

mysql_real_escape_string($name)

?

Hello I am having a problem trying to write to a database using mysql real escape so there wont be any injection attacks. I trying using myrealescape and it returns errors:
Code: [Select]
Notice: Use of undefined constant messageTo - assumed 'messageTo' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageSubject - assumed 'messageSubject' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17

Notice: Use of undefined constant messageBody - assumed 'messageBody' in D:\wamp\www\Legit Gaming Upload\LGU\includes\mailCompose.php on line 17
I add in the single quotes and it doesn't write either. Dreamweaver says that either single quotes or not there is no syntax errors.

What going on? I have used it like this befo ('$ID','" . mysql_real_escape_string($_POST[post_content]) . "') and no problems..

~AJ


<?php 
require_once('connect.php');

if(isset($_COOKIE['user'])){}else{
header( 'Location: members.php');
}

if (isset($_POST['sendBtn'])){

$messageFrom = $_COOKIE['user'];
$messageTo = $_POST['messageTo'];
$hash = $messageTo.$messageFrom.time();
$hash = md5($hash);

mysql_select_db("majik");

$sql="INSERT INTO messagesystem(ID, hash, messageTo, messageFrom, messageSubject, messageBody, messageDate, messageRead, messageDelete) VALUES ('','$hash','" . mysql_real_escape_string($_POST['messageTo']) . "','$messageFrom','" . mysql_real_escape_string($_POST['messageSubject']) . "','" . mysql_real_escape_string($_POST['messageBody']) . "','0','0')";

echo '<center>Your message was sent to: '.$messageTo.'</center>';


}


?>

I have never used real escape string so want to make sure I did it correctly. Also, if I can place it anywhere else to make it even more secure please let me know. This is just the action of a just a simple POST html form.

Here it is.
Code: [Select]
<?php
require ('staffarea/sql.php');
$showform="false";

$mcid = mysql_real_escape_string($_POST['mcid']);       
$age = mysql_real_escape_string($_POST['age']);
$description = mysql_real_escape_string($_POST['description']);

if(!mysql_query("INSERT INTO `somedatabase`.`appsubmissions` (`id`, `username`, `age`, `description`, `status`) VALUES (NULL, '$mcid', '$age', '$description', 'Pending');"))
{
echo '<div class=blockrow><b><font size=4>Submission Error</font><br /><br />Something went wrong. Contact Staff in the Support Forums and give them this information:<br /><br /></b><font color=red>';

echo mysql_error();

echo "</font>";

echo '<br /><br /><a href="/forumdisplay.php?f=14">Support Forums</a></div>';
}
else
{

$lastID=mysql_insert_id();

echo "<div class=blockrow><font size=3><b>$mcid, Thank You for your Building Application!</b></font><br /><br />";

echo "Your Unique Application ID: <b>", $lastID;

echo "</b> (save this so you can check the application status later)<br /><br />

Your application was submitted successfully. Please allow Staff 24 hours to accept or deny your application. If after 48 hours you still do not have building rights, assume the application was denied and re-submit with different information. DO NOT submit an application more than every 48 hours, doing so will get your account banned for spamming.<br /><br />

While waiting, you might check out the <a href=/index.php?pageid=mcguide>Ultimate Guide</a>.</div>";
}

mysql_close($con);

?>

Hello   I am still fairly new to the PDO / mysqli thing and I would really appreciate some help with escaping special characters from the below code.

$sth = ("SELECT * from table WHERE field1 = '$bob' and field2 != ''");

 foreach ($dbh->query($sth) as $row) {
  

 $who =  $row['field2']; 
  $why = $row['field1'];
 
$dbh1->query("UPDATE table SET who = '$who', date = '$row[DATE]', time = '$row[TIME]' WHERE field1 = '$why'")or die(mysqli_error($db));
}

I have tried using the prepared statement as well as the mysqli_real_escape_string but sees the code results as an object.   Any help or comments would be greatly appreciated.    

Hi,   I'm currently passing an array of values to be updated in my database, but am struggling on the best way to escape the quotation marks around the NOW statement below, as understand this will only work without them.
  This is what is being passed to the DB which does not currently work. I'm seeking some help to find the best way to remove the "" from around the NOW statement, but retain it in the array structure which i believe needs the '' to understand its a value.

UPDATE staff SET staff_last_login="NOW()" WHERE staff_id="1" 

array('staff_last_login'=>'NOW()')

My question is - whats the best way to escape this?   I understand forward slashes can sometimes be used, and double quotes - but feel like i have exhausted all my known options.   Any help much appreciated.   MoFish

on the first column do I need to escape that? "pm_id"
if so how do i do that with the right syntax
is it like this?
pm_id = '.mysql_real_escape_string.'


Code: [Select]
<?php $mail2 = "INSERT INTO pm SET pm_id = '', sendto = '".mysql_real_escape_string($to)."', sentfrom = '".mysql_real_escape_string($from)."' ?>
Also when you create a new row with a id  having auto increment. do i have to do id ="" so there isnt ever two rows matching the same id?

Hey Guys. I have a quick question. Should i "prep" input values coming from a radio or checkbox input field? Can an SQL injection occur through those 2 input fields, or is it only text fields?

Hi,
This escape function will only block quotes

How would you stop java script insertion?
 

function escape($string) {
    return htmlentities($string, ENT_QUOTES, 'UTF-8');
}

Thanks  

I enter the following:
select nam_last from names where nam_last = 'cohn' into a form field

When I print it in the next program I get
select nam_last from names where nam_last = \'cohn\'

Which generates an error:
SELECT Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'cohn\'' at line 1

What causes the \ to be added into the field, and how do I stop it?