Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.acorn.programmer > #701

Re: PHP query

Show all headers | View raw

In message <0374a80f52.Alan.Adams@laptop.adamshome.org.uk>
 on 8 Sep 2011 Alan Adams  wrote:

> and to follow up my last reply,
> 
> what really works properly is
> 
> echo "<input type='text' name='display' value=\"$readtest\">\n";
> 
> which puts the double quotes round the text in the html that results.

That won't work if the input itself contains double-quotes.  Try:

echo "<input type='text' name='display'
value=\"".htmlspecialchars($readtest)."\">\n";

Handling user-input safely is one of the most important things to learn when
using PHP.  Get to know the functions htmlspecialchars, urlencode and
addslashes (or the database-specific equivalent) and use them thoroughly. 
Failing to treat user-input carefully is what's behind many of the security
holes which have allowed web sites to be hacked.

If you don't have control over the magic quotes setting yourself, and
want to future-proof your code in case you use it on a server with a
different setting later, use this:

function myStripSlashes($a) {
  if (get_magic_quotes_gpc()==1) {
    return(stripslashes($a));
  } else {
    return($a);
  }
}

That will remove slashes from a string but only if the magic quotes feature
is on.

-- 
Matthew Phillips
Durham

Back to comp.sys.acorn.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-07 20:20 +0100
  Re: PHP query Robin Hounsome <robin@hounsome.org.uk> - 2011-09-07 21:29 +0100
  Re: PHP query Frank de Bruijn <zuiderduin@hotmail.com> - 2011-09-08 07:48 +0200
    Re: PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-08 20:49 +0100
      Re: PHP query Matthew Phillips <spam2011m@yahoo.co.uk> - 2011-09-08 22:09 +0100
        Re: PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-08 23:05 +0100
        Re: PHP query "John Williams (News)" <UCEbin@tiscali.co.uk> - 2011-09-10 00:47 +0200
          Re: PHP query Matthew Phillips <spam2011m@yahoo.co.uk> - 2011-09-13 20:46 +0100
            Re: PHP query "John Williams (News)" <UCEbin@tiscali.co.uk> - 2011-09-13 22:03 +0200
        Re: PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-13 22:39 +0100

csiph-web