Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17749

Re: Problems with accents

Show key headers only | View raw

andre wrote:

> Le 17/05/2018 12:32, Thomas 'PointedEars' Lahn a écrit :
>> But if the value is fixed, in this special case it is easier, and usually
>> better, to use another delimiter both for the PHP string and the HTML
>> attribute value:
>>
>>    echo '<P>INPUT NAME="titre" VALUE="l'homme">';
           ^------------------------------^

This is syntactically incorrect PHP code; should be at least

  echo '<P>INPUT NAME="titre" VALUE="l\'homme">';
  //   ^---------------------------------------^

instead.  [In this way, the PHP-based escaping works because the "attribute" 
value is delimited by <"> (straight quotation mark) instead.]

> The file called from a html form, is a php script generating HTML output.
> so in fact the line is:
> <P>INPUT NAME='titre' VALUE:'$Roww[0]' SIZE=60\n";

No, it is not.

> This to give users the possibility to modify a erroneous entry!

What I said before applies, then.  If the value can be entered this way 
(which AISB I do not think it should), you have to escape the previous, 
*user-provided* value for output in order to prevent code injection such
as cross-site scripting (XSS):

<https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet>

Next time, do not top-post:

<https://www.netmeister.org/news/learn2quote.html>

Also, while your real name is somewhat optional (it is considered polite), 
it is a violation of Internet standards and disregard of Network etiquette 
(Netiquette) to falsify address header fields and use foreign namespaces 
without authorization.  For example, your “pasmoi@pasici.be” is *presently* 
_not_ an e-mail address as *presently* pasici.be is not a registered second-
level domain (but may be in the future):

| Verifying <pasmoi@pasici.be>...
| Mail exchanger(s) for pasici.be: none.
| `A' record for pasici.be: 
| None, thus <pasmoi@pasici.be> is definitely not an e-mail address (no MX).

<http://www.interhack.net/pubs/munging-harmful/>

-- 
PointedEars
Zend Certified PHP Engineer <http://www.zend.com/en/yellow-pages/ZEND024953>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Problems with accents andre <ahr@blabla.be> - 2018-05-17 10:01 +0200
  Re: Problems with accents Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-05-17 12:32 +0200
    Re: Problems with accents andre <pasmoi@pasici.be> - 2018-05-17 13:36 +0200
      Re: Problems with accents Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-05-17 14:31 +0200
        Re: Problems with accents Jerry Stuckle <jstucklex@attglobal.net> - 2018-05-18 08:50 -0400
      Re: Problems with accents Jerry Stuckle <jstucklex@attglobal.net> - 2018-05-18 08:55 -0400
    Re: Problems with accents Jerry Stuckle <jstucklex@attglobal.net> - 2018-05-18 08:47 -0400
  Re: Problems with accents Richard Yates <richard@yatesguitar.com> - 2018-05-17 05:58 -0700
  Re: solved: Problems with accents andre <pasmoi@pasici.be> - 2018-05-18 17:13 +0200
    Re: solved: Problems with accents Jerry Stuckle <jstucklex@attglobal.net> - 2018-05-18 13:36 -0400
      Re: solved: Problems with accents andre <pasmoi@pasici.be> - 2018-05-19 10:09 +0200
        Re: solved: Problems with accents Jerry Stuckle <jstucklex@attglobal.net> - 2018-05-19 08:48 -0400
        Re: solved: Problems with accents Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-05-19 20:18 +0200
          Re: solved: Problems with accents Jerry Stuckle <jstucklex@attglobal.net> - 2018-05-19 18:33 -0400
            Re: solved: Problems with accents "Peter H. Coffin" <hellsop@ninehells.com> - 2018-05-20 10:44 -0500

csiph-web