[SOLVED] htmlspecialchars() & htmlentities()

[Andy17]

Hey guys,

 

 

I have just started coding a login system using PHP and MySQL. The system itself is irrelevant, but what I do want to ask is whether I should add htmlentities() to the variables below or not (and why/why not).

 

<?php

$email = sha1(mysql_real_escape_string(htmlspecialchars(trim(strip_tags($_POST['email'])))));
$password = sha1(mysql_real_escape_string(htmlspecialchars(trim(strip_tags($_POST['password'])))));

?>

 

Also, how secure is the above? Did I leave something out that leaves the script with a security breach? If it can improved somehow, I'd be happy to learn how. So basically I just wanted to know why one would add htmlentities() and why it improves the security. I did read the article at PHP.net but did not understand it 100%. I do understand what it does, just not why/when it's good/isn't good.

 

 

Thank you in advance.

[jxrd]

Because when echoing out people's username on pages, you don't want it to display HTML.

 

Also, why are you hashing the email address?

[Andy17]

Hehe I just wrote one of the lines and copied it and then later thought that I don't need to use sha1 on the mail.

[jxrd]

Yeah...that would make it  a bit difficult to email newsletters and stuff lol.

[roopurt18]

There are generally two times when you escape data. 

 

The first time is when you are putting it into the database.  In this case you use the appropriate escape method for your database, which is mysql_real_escape_string() for MySQL.  This replaces characters that are dangerous for the database with ones that aren't and protects from hackers abusing your HTML forms to inject arbitrary SQL into your database.

 

The second time you escape data is when you have taken it out of the database and are going to send it to the user's browser.  In this case it is a good idea to use htmlentities() and / or striptags().  This protects innocent users from abusive users who like to embed JavaScript or other dangerous content into their data with your PHP forms.

 

You do not typically use htmlentities() or striptags() when inserting data into the database; as a rule, valid data should go into the database intact.  That is you should be inserting it as close to the original form as possible and not calling htmlentities() or striptags() on it, but only mysql_real_escape_string() so that it doesn't harm the database.

 

In terms of encrypting, hashing, or masking, when you do these depends on the content of the data and the level of protection needed.  Passwords should be hashed before being inserted into the database.  Credit card info should be encrypted before going into the database and masked to look like XXXX XXXX XXXX 1234 when displaying to the user, assuming you're saving credit card info to begin with.

[Andy17]

Thanks guys. So basically I don't need to use trim, htmlentities or strip_tags since I am not inserting the data into the database (just checking whether it matches or not), assuming that I am not displaying it anywhere on my website... Is that correct?

 

And on the registration page, I would use mysql_real_escape_string when inserting and htmlentities(), strip_tags() and htmlspecialchars() when pulling out information.

 

I do, however, still not quite understand the difference between htmlspecialchars() and htmlentities(); I have used htmlspecialchars() and inserted <strong>test</strong> into a forum and displaying it, and it whiped out the tags just fine. That was with strip_tags() too, though. htmlentities() just displays it (in my test only "test" was displayed, the tags were just wiped out).

[jxrd]

htmlentities is the same as htmlspecial chars pretty much, and strip_tags removes the html tags altogether.

[Daniel0]

Things like

$password = sha1(mysql_real_escape_string(htmlspecialchars(trim(strip_tags($_POST['password'])))));

are also completely redundant. sha1 will always return a hexadecimal number, and there is no input to sha1() that is unsafe.

 

htmlentities is the same as htmlspecial chars pretty much

No they're not. Check the manual for the differences.

[jxrd]

Ok, well htmlentities will convert all possible html values whereas htmlespecialchars will only convert quotes and lt and gt signs. I think.

[roopurt18]

And on the registration page, I would use mysql_real_escape_string when inserting and htmlentities(), strip_tags() and htmlspecialchars() when pulling out information.

 

That's essentially it.

 

INSERTING INTO THE DATABASE

1) Does the data need to be protected (i.e: passwords, credit cards)?

  a) If yes, encrypt or hash the data using your appropriate algorithm.

2) Call the appropriate escape function for your database (i.e: mysql_real_escape_string())

3) Insert into the database

 

EXTRACTING DATA FROM THE DATABASE TO DISPLAY IN A WEB PAGE

1) Select the data from the database

2) Does the data need to be protected (i.e: show XXXX-XXXX-XXXX-1234 for credit cards, show ********* for passwords)

  a) If yes, protect the data however necessary

3) Call the appropriate escape function for display as HTML (i.e: htmlentities(), striptags())

4) Display the HTML

 

EXTRACTING DATA FROM THE DATABASE TO DISPLAY IN AS PLAIN TEXT, OR IN A NON-HTML REPORT (PDF, DOC, XLS)

1) Select the data from the database

2) Does the data need to be protected (i.e: show XXXX-XXXX-XXXX-1234 for credit cards, show ********* for passwords)

  a) If yes, protect the data however necessary

3) We no longer have to escape for output

4) Produce the output (i.e: plain text, XLS, DOC, PDF)

 

 

[Daniel0]

1) Does the data need to be protected (i.e: passwords, credit cards)?

  a) If yes, encrypt or hash the data using your appropriate algorithm.

 

Not quite enough for CC info, I'm afraid:

https://www.pcisecuritystandards.org/security_standards/download.html?id=pci_dss_v1-2.pdf

 

The lawyers from Visa, MasterCard, AmEx, et al. are going to rape you if you don't follow those specs.

[roopurt18]

Good point, although I took it on assumption that he's not writing anything that actually processes credit card information.  Someone who was probably wouldn't have posted this topic in the first place. 

[Andy17]

Sorry if I'm a little slow here... Wouldn't it be best to just always use htmlentities() (instead of htmlspecialchars()) when pulling out data for display on a website?

 

Thanks for all the replies, I learned a thing or two.

 

Also, I'm not going to be storing with credit cards! Not only do I not have enough experience with PHP, I do not know how to work with SSL either. It would also take a long time for me to feel comfortable storing information like that.

[roopurt18]

Sorry if I'm a little slow here... Wouldn't it be best to just always use htmlentities() (instead of htmlspecialchars()) when pulling out data for display on a website?

 

Read the user comments on:

http://www.php.net/htmlspecialchars

 

They will help explain when to use one or the other.  If you have further questions feel free to post them afterward.

[Andy17]

Thanks a lot guys, I appreciate it! I will take a look at those comments soon.