Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.acorn.programmer > #695 > unrolled thread

PHP query

Started byAlan Adams <alan@adamshome.org.uk>
First post2011-09-07 20:20 +0100
Last post2011-09-13 22:39 +0100
Articles 10 — 5 participants

Back to article view | Back to comp.sys.acorn.programmer

Contents

  PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-07 20:20 +0100
    Re: PHP query Robin Hounsome <robin@hounsome.org.uk> - 2011-09-07 21:29 +0100
    Re: PHP query Frank de Bruijn <zuiderduin@hotmail.com> - 2011-09-08 07:48 +0200
      Re: PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-08 20:49 +0100
        Re: PHP query Matthew Phillips <spam2011m@yahoo.co.uk> - 2011-09-08 22:09 +0100
          Re: PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-08 23:05 +0100
          Re: PHP query "John Williams (News)" <UCEbin@tiscali.co.uk> - 2011-09-10 00:47 +0200
            Re: PHP query Matthew Phillips <spam2011m@yahoo.co.uk> - 2011-09-13 20:46 +0100
              Re: PHP query "John Williams (News)" <UCEbin@tiscali.co.uk> - 2011-09-13 22:03 +0200
          Re: PHP query Alan Adams <alan@adamshome.org.uk> - 2011-09-13 22:39 +0100

#695 — PHP query

FromAlan Adams <alan@adamshome.org.uk>
Date2011-09-07 20:20 +0100
SubjectPHP query
Message-ID<aaf1210f52.Alan.Adams@laptop.adamshome.org.uk>
I am having problems dealing with input data containing the single 
quote character '

To test this, I use the input file as follows:

<html>
<head></head>
<body>
<form method=POST action="inputtest.php">
<input type="text" name="readtest">
<input type="submit" value="test">
</form>
</body>
</html>

The file inputtest.php contains:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Input Test</title>
<meta http-equiv="Content-Type" content="text/html; 
charset=iso-8859-1">
</head>

<body>
<?php
$readtest=$_POST["readtest"];
echo "<br>readtest=$readtest <br>\n";
echo "<form method=POST action='readtest2.php'>\n";
echo "<input type='text' name='display' value='$readtest'>\n";
?>
</form>
</body>
</html>

This works file for most input, producing the typed data in both the
readtest= line, and the input field.

however if the input data is O'Reilly then the result shows
readtest=O\'Reilly, and the input field holds O\

This is a problem, because the full application stores input in hidden 
text fields, and the result after these are submitted is a surname of 
O

How can I get the full input text into another text field? 
(fortunately a lot of this is done within a common function, so if I 
fix the function, all input can be handled correctly.)

Alan





-- 
Alan Adams, from Northamptonshire
alan@adamshome.org.uk
http://www.nckc.org.uk/

[toc] | [next] | [standalone]

#696

FromRobin Hounsome <robin@hounsome.org.uk>
Date2011-09-07 21:29 +0100
Message-ID<520f2847dbrobin@hounsome.org.uk>
In reply to#695
In article <aaf1210f52.Alan.Adams@laptop.adamshome.org.uk>,
   Alan Adams <alan@adamshome.org.uk> wrote:
> I am having problems dealing with input data containing the single 
> quote character '

[snip]

> $readtest=$_POST["readtest"];
            ^^^^^^^^^^^^^^^^^^
> echo "<br>readtest=$readtest <br>\n";
> echo "<form method=POST action='readtest2.php'>\n";
> echo "<input type='text' name='display' value='$readtest'>\n";
                                                ^^^^^^^^^^^
Try this

$readtest=stripslashes($_POST["readtest"]);

echo "<input type='text' name='display' value=\"$readtest\">\n";

Um... untested

Robin

-- 
Remote - http://www.hounsome.org.uk
TV display software for the Iyonix

[toc] | [prev] | [next] | [standalone]

#698

FromFrank de Bruijn <zuiderduin@hotmail.com>
Date2011-09-08 07:48 +0200
Message-ID<520f5b7e0dzuiderduin@hotmail.com>
In reply to#695
In article <aaf1210f52.Alan.Adams@laptop.adamshome.org.uk>,
   Alan Adams <alan@adamshome.org.uk> wrote:

> This works file for most input, producing the typed data in both the
> readtest= line, and the input field.

> however if the input data is O'Reilly then the result shows
> readtest=O\'Reilly, and the input field holds O\

Magic quotes for GET/POST/Cookie data must be active. Make sure it's
switched off in your php.ini:

magic_quotes_gpc = Off

If you don't have access to the php.ini used with that server, you can
try putting it in a .htaccess file:

php_flag magic_quotes_gpc off

I know this works with Apache but I'm not sure about WebJames.

Regards,
Frank

[toc] | [prev] | [next] | [standalone]

#700

FromAlan Adams <alan@adamshome.org.uk>
Date2011-09-08 20:49 +0100
Message-ID<0374a80f52.Alan.Adams@laptop.adamshome.org.uk>
In reply to#698
In message <520f5b7e0dzuiderduin@hotmail.com>
          Frank de Bruijn <zuiderduin@hotmail.com> wrote:

> In article <aaf1210f52.Alan.Adams@laptop.adamshome.org.uk>,
>    Alan Adams <alan@adamshome.org.uk> wrote:

>> This works file for most input, producing the typed data in both the
>> readtest= line, and the input field.

>> however if the input data is O'Reilly then the result shows
>> readtest=O\'Reilly, and the input field holds O\

> Magic quotes for GET/POST/Cookie data must be active. Make sure it's
> switched off in your php.ini:

> magic_quotes_gpc = Off

> If you don't have access to the php.ini used with that server, you can
> try putting it in a .htaccess file:

> php_flag magic_quotes_gpc off

> I know this works with Apache but I'm not sure about WebJames.

> Regards,
> Frank

and to follow up my last reply,

what really works properly is

echo "<input type='text' name='display' value=\"$readtest\">\n";

which puts the double quotes round the text in the html that results.

-- 
Alan Adams, from Northamptonshire
alan@adamshome.org.uk
http://www.nckc.org.uk/

[toc] | [prev] | [next] | [standalone]

#701

FromMatthew Phillips <spam2011m@yahoo.co.uk>
Date2011-09-08 22:09 +0100
Message-ID<76c9af0f52.Matthew@sinenomine.freeserve.co.uk>
In reply to#700
In message <0374a80f52.Alan.Adams@laptop.adamshome.org.uk>
 on 8 Sep 2011 Alan Adams  wrote:

> and to follow up my last reply,
> 
> what really works properly is
> 
> echo "<input type='text' name='display' value=\"$readtest\">\n";
> 
> which puts the double quotes round the text in the html that results.

That won't work if the input itself contains double-quotes.  Try:

echo "<input type='text' name='display'
value=\"".htmlspecialchars($readtest)."\">\n";

Handling user-input safely is one of the most important things to learn when
using PHP.  Get to know the functions htmlspecialchars, urlencode and
addslashes (or the database-specific equivalent) and use them thoroughly. 
Failing to treat user-input carefully is what's behind many of the security
holes which have allowed web sites to be hacked.

If you don't have control over the magic quotes setting yourself, and
want to future-proof your code in case you use it on a server with a
different setting later, use this:

function myStripSlashes($a) {
  if (get_magic_quotes_gpc()==1) {
    return(stripslashes($a));
  } else {
    return($a);
  }
}

That will remove slashes from a string but only if the magic quotes feature
is on.

-- 
Matthew Phillips
Durham

[toc] | [prev] | [next] | [standalone]

#702

FromAlan Adams <alan@adamshome.org.uk>
Date2011-09-08 23:05 +0100
Message-ID<f8e7b40f52.Alan.Adams@laptop.adamshome.org.uk>
In reply to#701
In message <76c9af0f52.Matthew@sinenomine.freeserve.co.uk>
          Matthew Phillips <spam2011m@yahoo.co.uk> wrote:

> In message <0374a80f52.Alan.Adams@laptop.adamshome.org.uk>
>  on 8 Sep 2011 Alan Adams  wrote:

>> and to follow up my last reply,
>> 
>> what really works properly is
>> 
>> echo "<input type='text' name='display' value=\"$readtest\">\n";
>> 
>> which puts the double quotes round the text in the html that results.

> That won't work if the input itself contains double-quotes.  Try:

I've just discovered that... and spent some time trying to fix it.

This message is now saved for reference. Thanks.

Alan

> echo "<input type='text' name='display'
> value=\"".htmlspecialchars($readtest)."\">\n";

> Handling user-input safely is one of the most important things to learn when
> using PHP.  Get to know the functions htmlspecialchars, urlencode and
> addslashes (or the database-specific equivalent) and use them thoroughly.
> Failing to treat user-input carefully is what's behind many of the security
> holes which have allowed web sites to be hacked.

> If you don't have control over the magic quotes setting yourself, and
> want to future-proof your code in case you use it on a server with a
> different setting later, use this:

> function myStripSlashes($a) {
>   if (get_magic_quotes_gpc()==1) {
>     return(stripslashes($a));
>   } else {
>     return($a);
>   }
> }

> That will remove slashes from a string but only if the magic quotes feature
> is on.



-- 
Alan Adams, from Northamptonshire
alan@adamshome.org.uk
http://www.nckc.org.uk/

[toc] | [prev] | [next] | [standalone]

#706

From"John Williams (News)" <UCEbin@tiscali.co.uk>
Date2011-09-10 00:47 +0200
Message-ID<52103c8e75UCEbin@tiscali.co.uk>
In reply to#701
In article <76c9af0f52.Matthew@sinenomine.freeserve.co.uk>, Matthew
Phillips <spam2011m@yahoo.co.uk> wrote:

> That will remove slashes from a string but only if the magic quotes
> feature is on.

How would you make that work on an array?

John

-- 
John Williams, Brittany, Northern France - no attachments to these addresses!
Non-RISC OS posters change user to johnrwilliams or put 'risc' in subject!
Who is John Williams? http://petit.four.free.fr/picindex/author/

[toc] | [prev] | [next] | [standalone]

#723

FromMatthew Phillips <spam2011m@yahoo.co.uk>
Date2011-09-13 20:46 +0100
Message-ID<105d3b1252.Matthew@sinenomine.freeserve.co.uk>
In reply to#706
In message <52103c8e75UCEbin@tiscali.co.uk>
 on 9 Sep 2011 John Williams (News) wrote:

> In article <76c9af0f52.Matthew@sinenomine.freeserve.co.uk>, Matthew
> Phillips <spam2011m@yahoo.co.uk> wrote:
> 
> > That will remove slashes from a string but only if the magic quotes
> > feature is on.
> 
> How would you make that work on an array?

Well, you would have to write code to iterate through the whole array.  You
could, if you wished, process the $_GET, $_POST, $_REQUEST and $_COOKIES
arrays to remove magic quotes at the outset.

There are examples of this sort of thing in the comments on the PHP manual on
the web.  It's not really Acorn-specific so best to discuss this elsewhere.

-- 
Matthew Phillips
Durham

[toc] | [prev] | [next] | [standalone]

#724

From"John Williams (News)" <UCEbin@tiscali.co.uk>
Date2011-09-13 22:03 +0200
Message-ID<52123cecd8UCEbin@tiscali.co.uk>
In reply to#723
In article <105d3b1252.Matthew@sinenomine.freeserve.co.uk>, Matthew
Phillips <spam2011m@yahoo.co.uk> wrote:

> There are examples of this sort of thing in the comments on the PHP
> manual on the web.  It's not really Acorn-specific so best to discuss
> this elsewhere.

Bien compris!  My code sorted!

Thanks,

John

-- 
John Williams, Brittany, Northern France - no attachments to these addresses!
Non-RISC OS posters change user to johnrwilliams or put 'risc' in subject!
Who is John Williams? http://petit.four.free.fr/picindex/author/

[toc] | [prev] | [next] | [standalone]

#725

FromAlan Adams <alan@adamshome.org.uk>
Date2011-09-13 22:39 +0100
Message-ID<acc1451252.Alan.Adams@laptop.adamshome.org.uk>
In reply to#701
In message <76c9af0f52.Matthew@sinenomine.freeserve.co.uk>
          Matthew Phillips <spam2011m@yahoo.co.uk> wrote:

<snip>

> Handling user-input safely is one of the most important things to learn when
> using PHP.  Get to know the functions htmlspecialchars, urlencode and
> addslashes (or the database-specific equivalent) and use them thoroughly.
> Failing to treat user-input carefully is what's behind many of the security
> holes which have allowed web sites to be hacked.

Interestingly, my O'Reilly "PHP in a Nutshell" book doesn't mention 
any of those.

<snip>


-- 
Alan Adams, from Northamptonshire
alan@adamshome.org.uk
http://www.nckc.org.uk/

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.acorn.programmer

csiph-web